Phishing in 2026: How to Spot the New Attacks (and What to Do If You Click)

• Phishing in 2026 is AI-generated, which means the old "bad grammar" tell is gone. Attackers use LLMs to produce flawless, contextual messages in any language.
• The most common vectors in 2026 are email, SMS (smishing), voice calls (vishing), and increasingly messaging apps (WhatsApp, Telegram, Signal).
• The defenses that work: a password manager that only autofills on the real domain, hardware-backed 2FA, and a habit of verifying via a different channel before acting.
• The most realistic scenarios in 2026 are business email compromise (BEC), package delivery smishing, and the "your boss is calling" voice clone attack. Know all three.
• If you click, do not panic. The right response depends on what you gave up: credentials, payment info, or just a click. We cover all three below.

Three big shifts:

Shift 1: AI-generated content. LLMs let attackers write flawless phishing emails in any language, personalized to your company, your role, your recent activity. The old "bad English" tell is gone. Many phishing emails are now indistinguishable from real corporate communications on language alone.

Shift 2: Multi-channel attacks. The same attack can arrive as an email, a text, a Slack message, a Teams ping, and a follow-up phone call. This is called "multi-channel phishing" and it works because people are less suspicious when an attack is reinforced across multiple sources.

Shift 3: Real-time proxying (adversary-in-the-middle). Modern phishing kits proxy your interaction with the real site in real time. You enter your credentials on a fake page; the kit immediately uses them on the real site. The 2FA code you receive gets asked for next; you type it in; the kit uses it in real time. This defeats SMS and most authenticator 2FA. Hardware keys (FIDO2/WebAuthn) are resistant because the key signs the domain it is actually on.

Scenario 1: Business Email Compromise (BEC)

A finance or HR person receives an email that appears to be from the CEO or CFO, asking for an urgent wire transfer or a change to payment details. The email uses the executive's real name, real title, and sometimes a real signature. The "urgent" framing is the hook — the target feels pressure to act fast.

The APWG tracked over $2.7 billion in BEC losses in 2023, the highest of any phishing category. The FBI's IC3 reports similar numbers year after year.

Tells:

Defense: Always verify out-of-band. If the CEO emails asking for a wire transfer, call the CEO on a known number. Never use the contact info in the email. This is the single most important rule.

Scenario 2: Package delivery smishing

A text claiming to be from USPS, Royal Mail, DHL, or FedEx saying your package is on hold and you need to confirm a small fee or update delivery preferences. The link goes to a fake site that steals your credit card or installs malware.

This is the most common SMS phishing in 2026. The APWG reports millions of these per quarter.

Tells:

Defense: Never click the link. If you think a package is actually on hold, go directly to the carrier's website or app.

Scenario 3: Voice cloning / "your boss is calling"

An attacker uses AI to clone a voice (from a public interview, a YouTube video, a podcast) and calls an employee pretending to be the CEO. The voice sounds real. The call is usually brief, urgent, and asks for a specific action (wire transfer, gift card purchase, credential disclosure).

The FTC issued a warning in 2023 after multiple high-profile cases. The technology has gotten good enough that voice cloning is now a standard tool in the attacker toolkit.

Tells:

Defense: Hang up. Call the person back on a number you know. Voice cloning is not yet good enough to fool people who are explicitly looking for it; it works when the target trusts the voice and acts fast.

Scenario 4: IT helpdesk / password reset

An email or text claiming to be from Microsoft, Google, your IT department, or your bank saying your password needs to be reset or your account has suspicious activity. The link goes to a fake login page.

Tells:

Defense: Never click the link in the email. Go directly to the service's website or app. If the alert is real, it will be there too.

Scenario 5: "You've been selected" / investment scams

A text or email claiming you've been selected for a job, a grant, an inheritance, or an investment opportunity. The hook is either a small upfront payment or credential disclosure to "verify your identity."

Tells:

Defense: If you did not enter a contest, you did not win it. If an investment sounds too good to be true, it is. Hang up, delete, block.

• Urgency ("need this done today")
• Change in payment method or bank details
• Slight domain mismatch (sarah@yourcompany.com vs sarah@yourcompamy.com)
• Request to keep it confidential
• You did not order anything
• The link does not match the real carrier's domain
• A small "redelivery fee" (typically $1-3)
• Urgent request for action
• Asks you not to verify with anyone else
• Caller claims to be in a meeting and cannot talk long
• Audio quality is sometimes subtly off (latency, slight distortion)
• Generic greeting ("Dear Customer")
• A link to a domain that looks plausible but is wrong
• Threatening language ("your account will be locked")
• You have no context for the offer
• It came out of nowhere
• The person on the other end pressures you to act now
• They want payment in unusual forms (gift cards, cryptocurrency, wire transfer)

Some patterns hold across all the scenarios above:

• Urgency or fear. "Act now or your account will be deleted." "You have 24 hours to respond." Real companies give you time.
• Secrecy. "Don't tell anyone about this." "Keep this between us." This isolates you from the people who would catch the scam.
• Pressure to bypass normal channels. "Don't call the helpdesk about this, I'll handle it." "Use this specific link, not the regular site."
• A request that does not match the person's role or normal behavior. A CEO asking a junior employee to wire $50,000 directly. A vendor changing payment details.
• A link that is technically correct but visually wrong. Hover to see. The visible text says "microsoft.com" but the actual URL goes elsewhere.
• An attachment you did not expect. Especially .zip, .html, .docm, or .iso files.
• A request for credentials, payment info, or 2FA codes via email, text, or call. Real companies never do this.

The single best habit: when you receive an action-requiring message, verify through a different channel.

The "different channel" is the key. Anyone calling you to ask for money or credentials is asking you to trust them as the only source. That is the attack. The defense is always a second source.

• Email asks you to wire money? Call the requester on a known number. Not the number in the email.
• Text claims to be your bank? Open the bank's app directly. Do not click the link in the text.
• Call claims to be from your IT helpdesk? Hang up, call the helpdesk number on your company's internal directory.
• Vendor emails about new payment details? Call the vendor's known contact. Confirm out-of-band.

The right response depends on what you gave up.

If you entered your password on a fake site (most common):

If you entered payment information:

If you entered an SMS or authenticator 2FA code on a fake site:

This is more serious because it means the attacker may already be in the account. Follow the steps above plus:

If you just clicked the link but did not enter anything:

If you installed software or ran a file from the link:

This is the worst case. The attacker may have installed malware.

• Immediately go to the real site (not by clicking the link) and change your password.
• If you used that password anywhere else, change it everywhere. This is why password managers generate unique passwords.
• Check the account for suspicious activity (sent emails, recent logins, password changes).
• Enable or verify 2FA on the account.
• If it was your primary email, check the email rules — attackers often add forwarding rules to keep access after you change the password.
• If it was a work account, contact IT immediately. Do not try to handle it alone.
• Call your bank or card issuer. Use the number on the back of the card or in the app. Report the suspected fraud.
• Dispute any unauthorized charges.
• Consider requesting a new card number.
• Watch for follow-up scams. Once scammers have your data, they often target you again with a "we can help you recover" scam.
• Force-logout all sessions on the affected account.
• Check the activity log for any actions you did not take.
• Change recovery email and phone number.
• Notify the account provider if you can.
• Close the browser.
• Clear cookies for the domain (the attacker may have set tracking cookies).
• Run a malware scan if you are on a personal computer.
• Watch for follow-up emails or texts from the same attacker trying again.
• No panic. Just clicking a link is rarely enough to compromise you in 2026.
• Disconnect from the network if you are on a work device.
• Run a full malware scan with your antivirus.
• If on a work device, contact IT immediately.
• If on a personal device and the scan finds something, consider a full system reinstall. Modern malware is hard to fully remove.
• Change passwords for important accounts from a different, known-clean device.

Reporting helps everyone.

• Email: Most email clients (Gmail, Outlook) have a "Report phishing" button. Use it. The reports feed into filters that protect other users.
• Text: Forward to 7726 (SPAM) in the US. In the UK, forward to 7726. Most carriers process these.
• Phone calls: Report to the FTC (reportfraud.ftc.gov in the US) or Action Fraud (actionfraud.police.uk in the UK).
• Work: Report to your IT helpdesk. Even if you did not click, the report helps them warn others.
• Anti-Phishing Working Group: reportphishing@apwg.org is a general reporting address used by many security vendors.

Phishing is the most common attack and the most preventable. The defenses are mechanical: a password manager that only autofills on real domains, hardware-backed 2FA, and a habit of verifying out-of-band before acting on requests for money or credentials.

The attacks will keep getting better. AI-generated, voice-cloned, multi-channel, real-time-proxied. You cannot spot every attack by looking. You defend by making stolen credentials useless (unique passwords + hardware 2FA) and by verifying action-requiring requests through a different channel.

Spend 20 minutes today. Set up the password manager, the 2FA, the verification habit. That is the entire defense.

• Password Managers in 2026: Why You Need One, Which to Use, How to Migrate
• Two-Factor Authentication in 2026: SMS vs App vs Hardware Key
• Voice Cloning Scams in 2026: The Family-Emergency Attack and How to Verify
• Deepfakes in 2026: How to Spot Them and When to Trust What You See
• How to Spot AI-Generated Content in 2026: Text, Images, Video, and Audio