S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T14.2
CATEGORY Social Engineering
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

Phishing

Digital Lure · Deceptive Impersonation Message · Ubiquitous
Critical
How It WorksSEC 01

Phishing sends deceptive messages — most often email — that impersonate a trusted sender to lure you into revealing credentials, clicking a malicious link, or running malware. A message arrives appearing to come from a party you trust — a bank, your IT department, a shipping company, a colleague — presenting a plausible reason to act now and a single convenient path to comply: a login page, an attachment, a request for a code or payment. The trusted appearance borrows credibility the attacker never earned; the manufactured urgency compresses the window in which you might otherwise pause and verify.

Mass (“bulk”) phishing casts a wide, generic net, relying on the fraction who bank with that institution and act reflexively. It differs from spear phishing, which tailors the lure to a specific person, and from business email compromise, a pure-text impersonation to redirect payment. The channel names the siblings: by phone it is vishing, by SMS smishing, by QR code quishing. The common engine is identical — substitute borrowed trust and time pressure for the verification that would expose the deception.

What has changed is the tooling, not the psychology. Phishing-as-a-service kits and, most consequentially, adversary-in-the-middle proxies now relay a victim’s login and the resulting session token in real time — defeating many one-time-code second factors. That is why the defensive frontier has moved from “spot the typo” to phishing-resistant authentication and out-of-band verification.

Warning SignsSEC 02
  • Look-alike sender. A domain that only resembles the real one — extra words, wrong TLD — visible on hover or in full headers.
  • Mismatched links. Visible link text and actual destination differ; hover to compare before clicking.
  • Generic greeting. "Dear Customer / User" instead of your name.
  • Manufactured deadline. "Suspended," "locked," "final notice" — a threat paired with one convenient remedy.
  • Emailed credential path. Any request to enter a password, one-time code, or payment via a supplied link rather than a known, bookmarked path.
  • Off-channel for the ask. Technically plausible, but arriving through a channel that party never uses for this.
Frequently Paired WithSEC 03
  • Spear Phishing · T14.3
    Targeted, researched variant
  • Vishing · T14.8
    Same lure over the voice channel
  • Smishing · T14.9
    Same lure over SMS
  • Business Email Compromise · T14.10
    Payment-redirect payload
How the Attack UnfoldsSEC 04
  • Stage 01 · Impersonate
    A message arrives wearing a trusted identity — bank, IT, brand, colleague — with familiar logos and layout that read as legitimate.
  • Stage 02 · Pressure
    A manufactured deadline or threat compresses the window to think and offers one convenient path to comply.
  • Stage 03 · Harvest
    You authenticate or pay through the supplied link; credentials, codes, or a live session are relayed to the attacker — adversary-in-the-middle kits capture even one-time-code MFA.
Counter-ProtocolSEC 05
Defense: Don't click, don't enter — verify out-of-band and authenticate only via known paths.
  • Verify out-of-band. For any account, security, or payment demand, reach the organization through a channel you already trust — bookmarked site, the number on your card — never the message's link.
  • Use known paths. Authenticate only via bookmarked / known routes; a password manager refusing to autofill on a look-alike domain is a built-in spoof detector.
  • Deploy phishing-resistant MFA. FIDO2 / WebAuthn keys or passkeys are origin-bound and resist adversary-in-the-middle relay (per CISA and NIST SP 800-63B).
  • Report it. Use the one-click report button so the security team can pull related messages and neutralize the campaign.