Phishing
Phishing is an attack that persuades a person to hand over credentials, data or money by impersonating something they trust. It is a social attack delivered through technical channels, which is why it survives every technical countermeasure aimed at it — the vulnerability is a person making a reasonable decision on false information.
| Attack type | Social engineering, delivered by email, SMS, voice, messaging apps or QR code |
| By channel | Email phishing; SMS is smishing; voice is vishing; QR-based is sometimes called quishing |
| By targeting | Mass campaigns, spear phishing against named individuals, whaling against executives |
| Objective | Credentials, session tokens, payment redirection, or malware installation |
| Current technique of note | Adversary-in-the-middle kits that relay one-time codes in real time |
| What it defeats | Any authentication factor a person can read and retype |
| What resists it | Origin-bound cryptographic authentication that cannot be relayed |
| Usual next step | Account takeover |
The variants, and why they are named separately
| Term | Channel or target | What distinguishes it |
|---|---|---|
| Phishing | Email, typically at scale | Low cost per attempt; succeeds on volume |
| Spear phishing | A named individual or small group | Researched and specific — far higher success rate |
| Whaling | Senior executives | A subset of spear phishing, aimed at payment authority |
| Smishing | SMS | Short messages strip the cues people use to judge legitimacy |
| Vishing | Voice calls | Real-time pressure; now augmented by synthetic audio |
Each has its own entry in this glossary because the defenses differ. Mass email phishing is substantially addressable by filtering; spear phishing is not, because a researched message to one person looks like legitimate correspondence. Smishing arrives on a device where inspecting a link is awkward, and vishing applies pressure in real time, which is exactly the condition under which people make poor decisions.
Why MFA stopped being the answer
For years the recommended response was to add a second factor, on the reasoning that a stolen password alone would no longer be enough. Attackers adapted, and the adaptation is worth understanding precisely because it changes what advice is still good.
Modern phishing kits operate as a real-time proxy. The victim lands on a page that looks correct because it is relaying the genuine site’s content. They enter a password, which the proxy forwards. The real site issues an MFA challenge, the proxy passes it along, the victim supplies the one-time code, and the proxy uses it within its validity window. In many cases the attacker then captures the resulting session token, which means they do not need to authenticate again at all.
The consequence: any factor a person can read and retype is relayable. SMS codes, authenticator app codes and push approvals all fall to this. What does not is authentication cryptographically bound to the real site’s origin, because the response the attacker relays is not valid for the domain they are operating. That is the meaningful dividing line, and it is not the same as having multi-factor authentication turned on.
Why phishing matters for identity verification
Phishing is rarely the objective. It is the first step, and where it leads determines what should defend against it.
Stolen credentials lead to account takeover. Once inside, the attacker meets whatever controls sit at step-up and, more importantly, at account recovery — which is where this concentrates, because an attacker who cannot defeat a hardware key will simply claim to have lost it. A recovery process resting on knowledge-based authentication rests on information that breaches have already published.
Re-establishing identity at recovery with an authenticated document and a live biometric asks a question the attacker cannot answer from harvested data. That is the practical link between phishing and document verification, and it is why Identity 360 treats enrollment, authentication and recovery as one problem. Synthetic and stolen identity controls address what the credentials are used for once they are taken.
What defenses can’t do
Filtering cannot stop a targeted message. A researched email from a compromised legitimate mailbox passes authentication because it is authentic.
Training reduces the rate, not the risk. Click rates fall with good training and never reach zero, and a single success is usually sufficient. Designing on the assumption that nobody will ever click is designing for a condition that will not hold.
Most MFA is relayable. Codes and push approvals are defeated by real-time proxies. Phishing resistance is a property of the method, not of having a second factor.
Nothing protects a session already stolen. A captured session token bypasses authentication entirely, because authentication already happened.
Frequently asked questions
What is the difference between phishing and spear phishing?
Phishing generally means mass campaigns sent at scale, succeeding on volume rather than quality. Spear phishing targets a named individual or small group using researched detail — their role, colleagues, current projects — which makes it far more convincing and much harder to filter.
Does multi-factor authentication stop phishing?
It raises the cost, and most forms no longer stop it. Real-time proxy kits relay one-time codes and push approvals within their validity window, and often capture the session token afterwards. Only authentication cryptographically bound to the genuine site’s origin resists relaying.
What happens after credentials are phished?
Usually account takeover. The attacker signs in, and then encounters step-up checks and the account recovery process. Recovery is where attacks concentrate, because it is designed to work for someone who has lost their factors — which is precisely what the attacker claims to be.
How does identity verification help against phishing?
Not at the point of the phish, which is a person being deceived. It helps where the stolen credentials get used — particularly at account recovery, where re-establishing identity against an authenticated document and a live biometric asks something an attacker cannot answer with harvested data.
Related reading
- Spear phishing — the targeted variant, and why filtering does not reach it
- Smishing — the SMS channel, where link inspection is hardest
- Account takeover fraud — where phished credentials usually end up
- CEO fraud — executive impersonation aimed at payment authority rather than credentials
