Innomerc One useful thing to do today
Pause before entering credentials or approving an unexpected request.
More everyday safety lessonsChoose your depth. Learn at your own pace.
Understand it
Phishing is a deceptive message intended to make you take an unsafe action: reveal a secret, approve a sign-in, open a file or send money. It can arrive through email, text, chat, a QR code or a call. Correct spelling and familiar branding do not prove authenticity.
In the fictional scenario, a delivery message creates urgency and asks you to sign in. Instead of following its link, open the service using a saved bookmark or its known app. Verify unusual financial or account requests through an independently obtained contact method.
Under the hood
A display name is different from the actual sender address. The visible link label can differ from its destination. Email authentication checks help with particular spoofing problems but cannot guarantee that a message is benign, especially when a legitimate account is compromised.
A phishing flow can capture credentials directly or relay authentication to a legitimate service. Typed one-time codes are vulnerable to relay. Origin-bound authentication such as WebAuthn reduces that specific risk, while session protection and recovery still matter.
Practitioner perspective
Evaluate the full action chain: delivery, click, credential entry, factor approval and post-login activity. A clicked link alone is not proof of credential theft; a clean email scan is not proof of safety. Preserve the message and relevant timestamps without forwarding sensitive attachments indiscriminately.
Correlate identity logs, mailbox rules, newly authorized applications and active sessions. Remediation depends on what happened. If credentials were entered, reset them through the genuine service and revoke relevant sessions; use the organization’s incident reporting route.
Phishing
Phishing is a deceptive message intended to make you take an unsafe action: reveal a secret, approve a sign-in, open a file or send money. It can arrive through email, text, chat, a QR code or a call. Correct spelling and familiar branding do not prove authenticity.
Illustrated analogy · Select the image to enlargeWatch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
A familiar-looking page can be the wrong page
Compare entering a secret with returning to the real service. This models information flow, not a real attack.
The design of a page does not prove who will receive the information.
How to use this example
Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.
What it means
Everyday example
State in this scenario
Inspect components & read every step
- You
The person making the decision in this fictional example.
Example: You decide whether to share information, approve a request or check it first.
- Fake page
A page impersonating a legitimate service.
Example: A copied sign-in page can send your entered password to a scammer.
- Scammer
A person using deception to obtain money, information or access.
Example: They send a misleading link and copy a familiar brand.
- Real service
The legitimate service you intended to use.
Example: You open its known app instead of following a suspicious message link.
Password entered
The design of a page does not prove who will receive the information.
- Fake page You: Sign in now. A lookalike page presents an urgent sign-in request.
- You Fake page: Password entered. The password is sent to the page you are using.
- Fake page Scammer: Secret copied. The scammer can receive the submitted information.
Real service opened
A known independent route avoids letting the message choose where you sign in.
- Fake page You: Urgent request. A page asks you to act immediately.
- You Real service: Known app. You open the service through your saved app or address.
- Real service You: Account status. Review whether the claimed problem exists in the real account.
Typed codes can be stolen too
Ordinary typed MFA codes can be relayed; MFA does not make a fake form safe.
- You Fake page: Typed code. A fake page also asks for a current sign-in code.
- Fake page Scammer: Code copied. The code can reach the scammer before it expires.
- Scammer Real service: Code used. The real service may accept a relayed code; site-bound passkeys work differently.
Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.
Open the detailed lesson walkthrough
Explore the system
Urgent message
A delivery notice asks for an immediate account sign-in.
Read every step without animation
Follow the message
- Urgent message. A delivery notice asks for an immediate account sign-in.
- Unverified link. The recipient follows a destination supplied by the message.
- Secret requested. A lookalike page asks for an account password.
The unsafe decision is trusting the message’s destination.
Verify independently
- Urgent message. The same request arrives with the same pressure.
- Known app. The recipient opens the genuine service independently.
- Check and report. No matching request exists, so the message is reported.
Independent verification breaks this deceptive path.
What could go wrong
A fictional delivery notice claims an account will close today. The attack relies on the recipient accepting that urgency before verifying the destination.
What you can do
- Pause before entering credentials or approving an unexpected request.
- Use the known app or bookmark and report suspicious messages.
- After exposure, act according to the data or permissions actually disclosed.
Common mistakes
- Professional writing is not proof that a message is genuine.
- Seeing HTTPS does not validate the sender’s claim.
Check your understanding
Active recall: explain this idea in 30 seconds
Phishing is a deceptive message intended to make you take an unsafe action: reveal a secret, approve a sign-in, open a file or send money. It can arrive through email, text, chat, a QR code or a call. Correct spelling and familiar branding do not prove authenticity.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.