What Is Phishing? How to Spot and Stop Fake Emails and Sites
Phishing is a scam that uses emails or text messages posing as real companies or government offices. They lure you to a fake site to steal your password or card number. A fake site can copy the real one's look, padlock included. So don't rely only on spotting fakes. Open services from the official app or a bookmark, and let tools such as passkeys protect you.
What you'll learn
- What phishing is, and what gets stolen
- How fake URLs are made to look real, and why the padlock can't tell you
- Why people keep falling for it
- Defenses that work (official apps, autofill, multi-factor authentication, passkeys)
- What to do if you typed something in
Prerequisites: none. Reading "What Does HTTPS Mean?" and "How Are Passwords Cracked?" first will make it easier to follow.
In everyday life
Have you ever received a text like this? "We tried to deliver your package, but no one was home, so we took it back." Emails such as "Suspicious use of your card. Please check right away" are common too. Tapping the link may bring up a login page that looks exactly like the real one.
Most messages like these are phishing. In Japan, the Council of Anti-Phishing Japan received about 2.45 million reports in 2025 alone. It is an everyday scam that reaches everyone. This article explains, step by step, how people get fooled and how to protect yourself.
What phishing is: posing as the real thing so you type it in yourself
Phishing is a scam that poses as a real company or public body. It lures you to a fake website, gets you to type in important information, and steals it. The names it uses include banks, card companies, online stores, delivery companies and mobile carriers. The word is a play on "fishing." Like an angler, the scammer uses bait to reel people in.
What gets stolen includes login IDs and passwords, card numbers and bank PINs. Some scams even ask for the confirmation code sent to your phone when you log in. The stolen details are used to log in, send money or shop without permission. Japan's IPA (Information-technology Promotion Agency) also warns that stolen personal data may be bought and sold among criminals.
The key point is that you type it in with your own hands. No one broke into your computer. However long your password is, typing it into a fake site hands it over. So the goal of defense shifts from "make it stronger" to "don't hand it over."
The way in: email and text messages
Most phishing arrives by email or SMS. SMS is the short text messaging that needs only a phone number. Anyone who knows your number can send you one, so scammers abuse it. Phishing by SMS is also called smishing (SMS plus phishing).
A fake missed-delivery text may lure you to a fake site. Some also try to get you to install a malicious app. Other scams use QR codes, in emails or on paper, to lead you to a fake site. "How QR Codes Work" covers the QR code case.
The sender can put any name in the "From" field of an email. A message that shows "XYZ Bank" may not come from that bank at all.
Trick 1: the text you see and the real destination are separate
A link in an email carries two pieces of information. One is the text shown on screen. The other is the address that actually opens when you tap it. Whoever writes the email sets these two separately. So the text can show the real company's address while the link leads to a fake site.
On a computer, rest the mouse pointer on a link without clicking, and its real destination appears. Microsoft advises checking that it matches the text in the email. On many phones, a long press on a link also shows where it goes. But even when you can see the destination, that doesn't make it genuine.
Trick 2: making a name that looks just like the real one
The string of characters that gives a web page's address is called a URL. It is the text that begins with "https://". The part after "https://" up to the first "/" is the name of the site.
This site name is called a domain name. Its parts are separated by dots, and the further right a part is, the larger the group it stands for. So you read it from the right. "How Does DNS Work?" explains this in detail. The part at the right end (the blue text in the figure) decides who owns the name.
There are three main ways to make a fake site's name. The figure shows examples. All of them are made-up names for this explanation.
The first way puts the real name on the left as decoration. The owner of a domain name can add anything they like to its left side. So "online-bank.example.login.example" is a site owned by whoever owns "login.example," at the right end. Seeing the real name on the left means nothing.
The second way is a name that differs by just one character. A lowercase "l" may become the digit "1," or a hyphen may be added. A small phone screen may show only part of the URL, which makes these easier to miss.
The third way uses letters from other alphabets. The Cyrillic alphabet, used for Russian and other languages, has letters that look almost the same as the Latin "a" and "p." They look the same, but to a computer they make a different name. Browsers such as Chrome show confusing names as a string of symbols starting with "xn--," so you can notice.
Trick 3: the padlock is not proof that a site is real
Many people learned that "a padlock (https) means it's safe." But the padlock shows only one thing: you have an encrypted connection with the site of that name. A fake site's owner can get a valid certificate (the site's electronic ID) for free. It just has to be for a domain name they registered themselves.
In fact, many phishing sites use HTTPS. According to APWG, an anti-phishing group, about 80% did in July to September 2020. In 2023, Chrome replaced the padlock in the address bar with a different icon to reduce the confusion. "What Does HTTPS Mean? What the Padlock Does and Doesn't Do" explains more.
Trick 4: what you type is used on the real site right away
Behind a fake site, the details you enter may be used at once. The attacker enters the ID and password typed on the fake site into the real site, on the spot. When the real site sends a confirmation code to your phone, the fake site asks for that code too. The code you type is also passed on to the real site right away.
This is called real-time phishing. Even a check that uses both a password and a confirmation code can be beaten this way. Japan's National Police Agency also warns people not to enter confirmation codes on fake sites. Passkeys, explained later, are designed so that this relay does not work.
Why do people keep falling for it?
Phishing persists because it targets how people think and feel, more than holes in technology. Tricks that exploit people's psychology or carelessness to get information are called social engineering. Common techniques include the following.
- Rushing you: A deadline such as "Confirm within 24 hours or your account will be suspended" takes away your time to think.
- Playing on worry or gain: They pick topics you can't ignore, such as suspected fraud, unpaid bills, prizes or points about to expire.
- Copying the real thing: Logos, wording and page designs can be copied as they are. In 2025, the reports in Japan named 229 impersonated brands.
- Matching the timing: Messages arrive when a real notice is likely, such as during tax-filing season (according to IPA).
- Sending in bulk: Email and SMS can reach huge numbers of people at little cost. Fooling just a tiny share is enough to make a profit.
People who were fooled were not especially careless. Real companies also send important notices by email and SMS. When a message that looks just like the real one arrives at a busy moment, anyone might tap it. That is why defenses that don't rely only on spotting fakes matter.
Defense 1: don't follow the link; open the service yourself
The most effective habit is never logging in from a link in an email or text. If a message worries you, open the service's official app or a bookmark you saved earlier. The Council of Anti-Phishing Japan's guideline for users (2026 edition) also recommends this.
Make the bookmark only once: check the correct domain name and type it in yourself. Install apps only from the official app store. If you check by phone, don't call the number in the email. For a card, call the number on the back of the card.
Defense 2: use password manager autofill as a check
A tool that stores your passwords and fills them in on login pages is called a password manager. Browsers and phones have one built in. Most password managers offer autofill only on sites whose domain name matches the one saved.
This behavior can help you notice a fake site. Your password usually fills in, but today no suggestion appears. In that case, you may be on a different site with a similar name. Google's and Microsoft's documentation for their browsers also lists this as one of their protections.
There are caveats. If no suggestion appears, don't copy the stored password and type it in by hand. Also, even on the real site, no suggestion may appear if the login page's address has changed. Autofill isn't proof. Use it as a signal to stop and think, "Something's wrong."
Defense 3: multi-factor authentication, and passkeys that are hard to fool
Checking who you are with something else, such as your phone, as well as your password is called multi-factor authentication. Even if your password is stolen, it alone is much less likely to let someone in. Turn it on wherever a service offers it.
In real-time phishing, though, the confirmation code is relayed too. Any method where a person reads a code and types it in fails once you type it into a fake site. That is why a login method called passkeys is spreading. It is based on standards created by groups including the FIDO Alliance, an industry body.
With passkeys, your phone or computer holds a separate "private key" for each site. The site keeps only the matching "public key." When you log in, the device uses the private key to make a digital signature and sends it. A signature is a mark that only the device holding that key can make. The private key itself never leaves the device.
What matters is that the key is tied to the name of the site it was registered with. The browser tells the device the name of the site that is open. A fake site's name differs from the registered one, so the device does not make a signature. Even when a person fails to spot the fake, the machine compares the names and stops it.
When you use a passkey, you confirm with your fingerprint, face or screen-lock PIN. This only checks, inside the device, that the key may be used. Your fingerprint or face data is not sent to the site. In May 2022, Apple, Google and Microsoft jointly announced that they would expand support for passkeys. Some services still don't offer them, though. If logging in with a password is still allowed, attackers can target that. Also, passkeys protect only the login. If you type a card number into a fake site, it will still be stolen.
Defense 4: let filters and warnings help
Email and SMS services have filters that set aside suspicious messages automatically. Browsers also show a warning page when you try to open a reported fake site. The Council of Anti-Phishing Japan's guideline also recommends turning these features on.
But they mainly block fakes that have already been found. A brand-new fake site can slip through. So use them this way: if a warning appears, don't go ahead. If none appears, don't assume you're safe.
If you typed something in
If you realize you entered information on a fake site, take the steps below in order. The sooner you act, the less harm is done. The steps and contacts are those given by Japanese authorities. Outside Japan, contact your own bank, card company and local police.
- Change your password: Open the real site from its official app or a bookmark and change it there. Also change it on every other service where you use the same password (advice from Japan's National Police Agency).
- If you entered a card number, contact the card company: Call the number on the back of the card and have the card stopped (advice from the Japan Consumer Credit Association and the National Police Agency).
- If you entered bank details, contact the bank: If you entered a PIN or a confirmation code, tell your bank right away too.
- Talk to the police: In Japan, contact your prefectural police's consultation desk, or call the police consultation line "#9110." Keep the email, the fake site's URL and screenshots; don't delete them.
On services that show your login history, also check for logins from unknown devices and for changes to your account details.
If you didn't open the link and entered nothing, deleting the email or text is enough. IPA also advises ignoring and deleting emails and texts you don't recognize. It is different if you installed an app from a fake text, though. In that case, IPA advises switching to airplane mode, deleting the app, resetting the device and changing your passwords.
Common myths
Myth: Watch for emails with clumsy language, and you'll spot the fakes
In fact, many read naturally, copying the real company's wording and logo. The myth comes from the past, when awkward language was often a giveaway. The Council of Anti-Phishing Japan also says that leaving users to judge whether a URL is genuine cannot fully prevent harm. The habit of not opening links is more reliable than trying to spot fakes.
Myth: If there's a padlock and the URL starts with https, the site is real
In fact, the padlock shows only that you have an encrypted connection with the site of that name. A fake site can also get a certificate for its own name, so it gets a padlock too. The myth comes from the days when few sites used HTTPS and people were widely told to "check for the padlock."
Myth: With multi-factor authentication turned on, you don't need to worry about phishing
In fact, a confirmation code typed into a fake site can be passed on to the real site on the spot. Multi-factor authentication is a strong defense when only your password is stolen, but it isn't foolproof. Methods where the device checks the site's name, such as passkeys, hold up much better against phishing.
By the numbers
| Item | Figure | Period and source |
|---|---|---|
| Reports to the Council of Anti-Phishing Japan | About 1.72 million → about 2.45 million (about 1.43×) | 2024 → 2025, Council of Anti-Phishing Japan |
| Brands impersonated in those reports | 229 | 2025, Council of Anti-Phishing Japan |
| Unauthorized online-banking transfers in Japan | 5,578 cases, about ¥8.73 billion | 2023, National Police Agency (Japan) |
| Same as above | 4,369 cases, about ¥8.69 billion | 2024, National Police Agency (Japan) |
| Same as above | 4,747 cases, about ¥10.4 billion | 2025, National Police Agency (Japan) |
| Share of those transfers that used phishing | About 90% | 2024 and 2025, National Police Agency (Japan) |
The report count is the number of reports the council received, not the number of victims. Many people may report the same fake email. Still, it gives a sense of how many are being sent.
In Japan, losses from unauthorized online-banking transfers reached about ¥10.4 billion in 2025. That beat the previous record of about ¥8.73 billion, set in 2023. The National Police Agency says phishing was the method in about 90% of these transfers in 2024 and 2025.
Learn more
- What the padlock and certificates do and don't protect: What Does HTTPS Mean?
- How passwords are stored, the danger of reusing them, and how multi-factor authentication works: How Are Passwords Cracked?
- Why domain names are read from the right, and how a name is turned into a numeric address: How Does DNS Work?
- The technology behind passkeys: What Is Encryption?, public-key cryptography
- Why firewalls have trouble stopping fake sites: What Is a Firewall?
- Why multi-factor authentication became standard at work: Perimeter Security vs Zero Trust
- Test how length affects a password's strength: the password brute-force time calculator