Phishing: A fraud technique in which an attacker poses as a trusted sender to manipulate people into sharing sensitive information, approving payments or opening malicious links or files.
Also known as: Phishing attack, Spear phishing, Whaling
Key takeaways
- Phishing impersonates someone you trust to make you act before you think.
- It arrives by email, SMS (smishing), chat apps, social media and voice calls (vishing).
- Warning signs: urgency, unusual requests, mismatched sender details and links to login pages.
- Verify unusual requests through a second channel you already trust.
- In C Chat, never share your sign-in code, and use block and report on suspicious accounts.
Phishing has been around for decades and still works because it targets people, not software. The tactics change, from fake bank emails to messages that look like a colleague asking for a favor in a group chat, but the structure stays the same. Recognizing that structure is the best defense your team has.
Phishing: a plain definition
Phishing is impersonation with a goal. The attacker pretends to be someone you trust, such as your bank, a supplier, your manager or a delivery company, and asks you to do something that benefits them: log in on a fake page, pay an invoice, share a code or open an attachment.
The word comes from “fishing”: cast a lure and wait for a bite.
How it works
Most phishing attempts follow a recognizable pattern:
- Research or guess a context. Attackers use public information, such as company websites, social profiles and job titles, to pick a believable sender.
- Create the lure. A message that looks routine: a shared document, an unpaid invoice, a password expiry warning, a delivery problem.
- Add pressure. Deadlines, threats or authority: “Pay today or the account closes”, “The director needs this in 10 minutes”.
- Ask for one action. Click, log in, pay, reply with a code or download a file.
- Exploit the result. Use the stolen credentials, money or access, often to phish the next victim.
Phishing over SMS has its own name, smishing, and phishing is the most common form of the broader social engineering.
Why it matters for business messaging
Work chats are an attractive channel because people trust messages from inside their team and respond quickly from their phones. A small screen also hides details such as the full sender address or the real link.
Common chat-based scenarios include:
- A new account using a manager’s name and photo asking for an urgent gift card purchase.
- A “supplier” sending a link to updated bank details for invoices.
- A message asking you to forward the login code you just received.
Once an attacker has a code, they can complete an account takeover and message colleagues as you. The guide on how to spot phishing in chat apps includes real-world examples and a short checklist for staff.
How it relates to C Chat
C Chat signs people in with a one-time code sent by SMS or email, with no password to phish. That removes one target but makes the code itself valuable, so the rule is simple: never share a sign-in code with anyone.
Other C Chat features help teams resist phishing:
- Recognizable identities. People have a name, photo and optional @username, and team members appear inside your team, so an outsider is easier to notice.
- Block and report. Any suspicious account can be blocked and reported; see block and report. Reported messages may be reviewed for moderation, and that platform access is logged.
- Group oversight. Owners and admins can audit group conversations to check what was sent after an incident.
Staff phone hygiene matters too; share mobile security basics for staff phones with new hires.
Related terms and common misconceptions
- “Only careless people fall for phishing.” Well-crafted attacks fool experienced staff, especially when they are busy.
- “Two-factor authentication stops phishing.” It helps, but real-time phishing kits can relay codes. A SIM swap can also intercept SMS codes.
- “It only happens by email.” Chat apps, SMS and voice calls are all common channels.
Getting started
Move your team’s work chats into a space where members are known and suspicious accounts can be reported: create a team at getcchat.com/c. Read more about protections on the security page.
Frequently asked questions
What are the main types of phishing?
Mass phishing sends the same lure to many people. Spear phishing targets a specific person using researched details. Whaling targets executives. Smishing uses SMS, vishing uses voice calls, and business email compromise impersonates a boss or supplier to redirect payments.
What should I do if I clicked a phishing link?
Don't enter anything else. If you typed a password or code, change it immediately from the real site and sign out of other sessions where possible. Tell your IT contact or team admin so they can warn colleagues and watch for misuse.
Can phishing happen inside a work chat app?
Yes. Attackers create accounts with a colleague's name and photo, or use a compromised account to message the team. A message asking for a code, a payment or a login from inside a familiar chat deserves the same suspicion as an email.
How can I tell if a message is from the real person?
Check details you can verify: the @username or phone number rather than the display name, whether they are a known member of your team, and whether the request fits their role. When in doubt, call them on a number you already have.