What is phishing? How to recognize targeted scams
Learn what phishing and spear phishing mean, how deceptive messages work, and what to do when a message asks for a sensitive action.
Phishing is a form of social engineering that uses deceptive messages or websites to persuade someone to disclose information, open a malicious attachment, approve a login, or take another action that benefits an attacker. Messages can arrive by email, text, voice, or a third-party service. See the [NIST definition of phishing](https://csrc.nist.gov/glossary/term/phishing) and [CISA's phishing tip sheet](https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Phishing-Tip-Sheet.pdf).
## What makes spear phishing different?
Spear phishing is a targeted form of phishing. A message may refer to a real project, supplier, or colleague to make a request seem plausible; those details do not prove the sender is genuine. [MITRE ATT&CK](https://attack.mitre.org/techniques/T1566/) describes targeted and non-targeted phishing and its delivery methods.
A fictitious example: a message appearing to come from a supplier asks a finance employee to change payment details urgently. The employee checks the request using a previously verified phone number and follows the organization's approval process. Do not use the phone number or link provided in the suspicious message as your only verification channel.
## Signals to examine
Unexpected requests for credentials, payment changes, login approvals, sensitive files, links, or attachments deserve a second check. A familiar name or a convincing message alone does not verify the sender. Poor spelling can be a clue, but a well-written message may still be fraudulent. Avoid opening links or attachments while checking the request.
Use a trusted bookmark, the official app, or a contact number you already verified to ask the supposed sender. Report suspicious messages using your organization’s process or the mail provider’s reporting feature. Follow the service provider’s advice rather than forwarding sensitive message contents to an untrusted party.
## If you already interacted
If you entered credentials or approved an unexpected login, contact your organization's security team or the affected service through a known official channel. Use the service's account recovery instructions, review recent activity, and change compromised credentials where directed. If money may have moved, contact the financial institution promptly. Keep original messages and records according to the guidance you receive; do not send passwords, authentication codes, or private keys to Mithril or anyone claiming to investigate for you.
## Where multifactor authentication fits
Multifactor authentication (MFA) requires more than one distinct type of factor. It can reduce risk, but some attacks also target MFA approvals or codes. Where available, choose a phishing-resistant method supported by your service and follow its setup guidance. See [NIST's MFA definition](https://csrc.nist.gov/glossary/term/multi_factor_authentication) and [CISA's phishing-resistant MFA guidance](https://www.cisa.gov/sites/default/files/2023-01/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf).
Mithril's public phishing check compares a supplied domain with a dated catalog; a missing match does not prove a site is safe, and an unavailable catalog cannot produce a verdict. For a broader response plan, see [Mithril's response guide](https://mithril.fund/under-attack). Sources were reviewed on 2026-10-29. This guide is general information, not a guarantee of detection or recovery.