Join our Newsletter — 33% off our NHI Course

Common Phishing Types

Common phishing types are the main ways attackers trick people or systems into revealing secrets, approving access, or running malicious actions. They include email phishing, spear phishing, smishing, vishing, and whaling. Each uses social engineering to steal credentials, tokens, or other authentication data, often to bypass IAM controls.

What common phishing types do

Common phishing types are the main ways attackers trick people or systems into revealing secrets, approving access, or running malicious actions. They work because the lure looks routine, urgent, or familiar enough to bypass attention and normal verification.

Phishing is not one single technique. Email phishing, spear phishing, smishing, vishing, whaling, and related variants differ mainly in delivery channel, target selection, and the trust relationship they try to exploit.

How common phishing types differ

Email phishing is the broad, high-volume form, while spear phishing narrows the message to a specific person, role, or relationship. Whaling is a further specialization aimed at executives or other high-value targets.

Smishing uses text messages, and vishing uses voice calls or voicemail. These channels matter because they can feel more immediate and less scrutinised than email, especially when the attacker pushes the victim to act quickly.

What these types share is social engineering. The attacker is usually trying to capture credentials, tokens, one-time codes, or consent that can be reused to reach accounts, systems, or internal tools.

Why phishing succeeds

Phishing succeeds when it fits normal work patterns: a login prompt, a package notice, a shared document, a request from “support,” or a message that claims urgency. The stronger the impersonation, the more likely the victim is to follow the attacker’s path without pausing to verify.

The danger is not limited to password theft. Modern phishing often targets session tokens, OAuth consent, device-code approvals, payment workflows, and other trust decisions that can bypass simple password checks.

That makes phishing a control-bypass problem as much as a deception problem. Even strong IAM can fail if the human decision point is manipulated or if the organisation still trusts low-friction sign-in and approval flows too much.

How defenders should think about phishing types

Defenders should treat phishing as a family of entry techniques, not a single awareness issue. The practical question is which lures, channels, and impersonation patterns are most likely to reach your users, contractors, and support workflows.

A useful baseline is to pair user education with phishing-resistant authentication, tight approval workflows, and detection of suspicious links, domains, attachments, and consent events. NIST’s Digital Identity Guidelines are relevant because phishing becomes far less effective when authentication is designed to resist credential replay and approval abuse.

For security teams, the main operational task is to map likely phishing types to the systems they target, then decide which messages, sign-in events, and consent grants deserve immediate scrutiny.

Risk and Threat Considerations

Phishing creates direct exposure to account takeover, token theft, fraudulent approvals, malware delivery, and lateral movement. The risk rises sharply when the message can reach privileged users, support staff, or anyone who can approve access, reset credentials, or reveal sensitive information.

Failure mechanism: The attacker abuses trust, urgency, and familiarity to make the victim bypass normal verification and hand over a credential, token, approval, or execution step that the attacker can reuse.

Impact: The result can be session hijack, unauthorized access, data theft, financial loss, internal compromise, or a larger intrusion path if the stolen access unlocks additional systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST SP 800-63 IAL — Identity Assurance Level Phishing targets identity proofing and authenticators.
Recommendation — Use phishing-resistant authenticators and reduce replayable secrets.
NIST SP 800-53 Rev 5 IA-2 — Identification and Authentication (Organizational Users) Phishing steals or abuses user credentials and sign-in flows.
IA-5 — Authenticator Management Phishing often captures passwords, tokens, and other authenticators.
Recommendation — Harden user authentication and monitor anomalous sign-in activity. Rotate, revoke, and protect authenticators that may be exposed through phishing.
MITRE ATT&CK T1566 — Phishing The term is centered on adversary phishing techniques and delivery variants.
Recommendation — Map observed lure patterns to T1566 and hunt for the supporting tradecraft.
CIS Controls v8 CIS-9 — Email and Web Browser Protections Common phishing types are commonly delivered through email and malicious links.
Recommendation — Filter malicious mail and web destinations before they reach users.

Practitioner Guidance

Why practitioners should care: The type of phishing matters because different lures require different controls. Email filtering alone will not fully address smishing, vishing, OAuth consent abuse, or executive-targeted campaigns.

What to watch for: Sudden login prompts, unexpected consent requests, unusual callback instructions, impersonated support contacts, and messages that pressure users to act outside standard process should all be treated as suspicious. Phishing Guide is a useful reference for the major phishing patterns and layered defences that reduce these failures.

Practitioner takeaway: The best response is to tune controls to the specific phishing type, because the attacker’s channel and objective determine which trust boundary is being attacked.