Phishing Attack Prevention: Spot and Stop Scams

About 10 min read

Published: March 26, 2026Last updated: September 4, 2026

Phishing is an attack method that steals personal information such as passwords and credit card details through fake emails and websites impersonating legitimate services. A phishing site can copy the HTML and images of the real site verbatim, so a fake cannot be told apart from the real thing at a glance. According to the Council of Anti-Phishing Japan's annual phishing report for 2025, the council received approximately 1.718 million phishing reports over the course of 2024 - the highest annual figure recorded up to that year, and roughly a 1.44x increase over the previous year. At this scale, phishing is no longer a rare scam you happen to run into by bad luck: it is a threat to prepare for on the assumption that it routinely reaches anyone's inbox. This article explains specific tips for spotting phishing scams, differences from similar attack methods, and practical defenses using passtsuku.com.

Types of Phishing Attacks and Their Differences

Phishing attacks are classified into several types based on the scope of their targets and the sophistication of their methods. Understanding each type makes it easier to identify which kind of attack you may be facing.

General Phishing

This method involves mass-sending fake emails impersonating banks or e-commerce sites to a broad audience. Subject lines that create urgency - such as "Your account has been suspended" or "Unauthorized access detected" - rob recipients of calm judgment and lure them to fake sites. The cost to attackers is extremely low; sending millions of emails and tricking even 0.1% of recipients is enough to turn a profit.

Spear Phishing

Spear phishing is an attack that targets specific individuals or organizations. Attackers research the target's job title, business partners, and recent projects through social media and public corporate information, then craft highly convincing emails incorporating those details. Bulk phishing does not know the recipient's situation, so some part of the message fails to line up with what the recipient actually knows, and that friction is what makes people suspicious. Spear phishing removes the friction by weaving in real business partner names and ongoing projects, taking away the very cue that would prompt someone to question the message - which is exactly what social engineering aims for. In-house abbreviations and approval workflows are reproduced as well, so the recipient no longer has the assumption that an outsider could not know this much. Knowledge of social engineering defense is valuable for protection.

Whaling

Whaling is a type of spear phishing that targets C-suite executives and senior management. A typical tactic is Business Email Compromise (BEC), where attackers impersonate a CEO or CFO to instruct accounting staff to make urgent wire transfers. According to the FBI's IC3 annual report for 2022, BEC accounted for 21,832 complaints and total losses of approximately $2.7 billion that year alone. The damage per incident is orders of magnitude larger than typical phishing.

How to Identify Phishing Emails

Phishing emails are sent impersonating banks, e-commerce sites, delivery services, and more. Beyond phishing, spam and scam messages are also everyday threats. By checking the following points, you can detect many phishing emails. The key is not to rely on a single criterion but to evaluate multiple points comprehensively.

Check the Sender Address

If an email is from a legitimate company, the sender domain matches the official website. For example, even if it appears to be "support@example-bank.co.jp", the actual domain may be tied to a different domain like "example-bank.co.jp.attacker.com". Check the email header details carefully to determine whether the sender domain is genuine.

The reason this technique works lies in a design flaw of the email protocol (SMTP). SMTP is an old protocol established in 1982 that does not include a built-in mechanism for verifying the sender's identity. This makes sender address spoofing technically easy. To counter this, sender domain authentication technologies such as SPF, DKIM, and DMARC were developed, but not all mail servers implement them correctly, and spoofed emails still reach recipients in some cases.

Natural-Sounding Wording Is Not Evidence

Phishing emails created by overseas attackers may contain unnatural language. Signs include improper use of honorifics, misplaced punctuation, and awkward phrasing. However, large language models learn phrasing from vast amounts of real-world text, so phishing emails crafted by abusing them simply do not show these traditional tell-tale signs such as awkward honorifics or punctuation. Treat natural-sounding text as no proof that an email is genuine. For details on these tactics, seethe latest AI-powered phishing techniques. Please use technical verification points in addition to the text itself.

How to Identify Phishing Sites

Carefully Check the URL

Phishing sites are designed to closely resemble legitimate sites. Since visual appearance alone makes them hard to distinguish, checking the URL is the most reliable method. Verify that the domain shown in the browser address bar exactly matches the legitimate service.

A common technique used by attackers is typosquatting - registering domain names similar to legitimate ones. For example, replacing "amazon" with "amaz0n" or "google" with "go0gle" exploits subtle differences that are hard to notice at a glance. An even more advanced technique is the homograph attack, which abuses Internationalized Domain Names (IDN) to make Cyrillic "а" (U+0430) look identical to Latin "a" (U+0061). Since they appear completely identical to the naked eye, make it a habit to access sites via bookmarks or search engines rather than relying on visual inspection alone.

HTTPS Alone Is Not Enough

The belief that "a padlock icon means it's safe" is incorrect. With the spread of free certificate authorities like Let's Encrypt, obtaining SSL/TLS certificates has become easy, and the operators of fake sites obtain certificates through the very same procedure. A domain-validated certificate from a free certificate authority is issued once the applicant proves only that they control the domain, so an attacker using a lookalike domain they registered themselves clears that check without difficulty and gets the same padlock. HTTPS only indicates that communication is encrypted; it does not guarantee the legitimacy of the site. Even an EV (Extended Validation) certificate does not fully guarantee a site is not phishing. Regardless of certificate type, verifying the domain name itself is the top priority.

Phishing via DNS Spoofing

An advanced technique that can deceive you even when you correctly verify the URL is DNS spoofing. By forging DNS responses, this attack redirects you to a fake site prepared by the attacker even when you enter the legitimate domain name. The principle behind this attack is that the DNS protocol lacks a mechanism to verify the authenticity of responses. If the DNS settings on a user's PC or router are tampered with, the browser address bar displays the legitimate URL while actually connecting to a fake site. Effective countermeasures include using trusted DNS services (Google Public DNS: 8.8.8.8, Cloudflare DNS: 1.1.1.1) and enabling DNS over HTTPS (DoH).

Steps to Take After a Password Leak

If you have fallen victim to a phishing scam or suspect a password leak, follow these steps promptly. The longer you delay, the more the damage spreads, so it is crucial to act immediately upon discovery. Prioritize protecting your email account above all else. If your email is compromised, password resets for all other services fall into the attacker's hands.

• Immediately change the password for the affected service
• Change passwords for other services where you reused the same password
• Enable two-factor authentication if not already set up
• Contact your credit card company if you entered card information
• Check for suspicious login history
• Report to the affected service's support team

A common misconception is thinking "I'm safe once I change my password," but the attacker may have already changed the account's recovery email address or phone number. After changing your password, always verify that recovery settings and contact information have not been tampered with. Also, if you have granted access to other apps via OAuth, the attacker may have linked malicious apps, so check your list of connected apps as well.

Practical Anti-Phishing Checklist

To protect yourself from phishing scams on a daily basis, regularly review the following checklist. By defending from both technical measures and behavioral habits, you can significantly reduce the risk of damage.

• Do not click links in emails directly; access official sites via bookmarks
• Always check the URL in the address bar before entering a password
• Be suspicious of emails that create urgency (e.g., "Your account will be suspended within 24 hours")
• Verify that the sender address domain matches the official one
• Set up two-factor authentication for important accounts
• Enable phishing detection features in your browser and email client
• Keep your OS and browser up to date at all times
• Report suspicious emails to the Anti-Phishing Council

Regularly Update Passwords with passtsuku.com

One of the most effective defenses against phishing is setting strong, unique passwords for each service and updating them regularly. Even if you enter a password on a phishing site, using different passwords for each service limits the damage to a single service. Furthermore, regular changes minimize the window of opportunity for attackers.

With passtsuku.com, you can instantly generate strong random passwords. When updating, set the length to 16 or more characters and enable all four character types: uppercase, lowercase, numbers, and symbols. If the strength meter shows 80 bits or more of entropy, the strength is sufficient. When updating passwords for multiple services at once, the batch generation feature of passtsuku.com is convenient. After generation, use the batch copy feature to copy to your clipboard and register them in your password manager.

Recommended Update Frequency

• Financial services: once every 3 months
• Email accounts: once every 3 to 6 months
• Social media: once every 6 months
• Other services: change immediately upon receiving a breach notification

Fundamental Protection with FIDO2 Security Keys

FIDO2-compatible security keys are gaining attention as the ultimate solution for phishing protection. In FIDO2 authentication, the browser cryptographically verifies the domain of the connection target during authentication, eliminating the risk of entering passwords on phishing sites altogether. Google mandated the use of security keys for all employees (over 85,000) in 2017 and reported zero account compromises from phishing since then. This case demonstrates that technical measures are far more reliable than those dependent on human attention.

What You Can Do Right Now

1. Stop clicking links in emails directly and access official sites via bookmarks
2. Set up two-factor authentication (authenticator app recommended) for email accounts and financial services
3. Generate unique passwords of 16+ characters for each service using passtsuku.com to eliminate password reuse
4. Enable "HTTPS-Only Mode" in your browser to reduce the risk of connecting to phishing sites
5. Report suspicious emails to the Anti-Phishing Council (info@antiphishing.jp)

Frequently Asked Questions

How can I identify phishing emails?

Check the sender domain, hover over links to verify URLs, and be wary of urgent language. Legitimate services never ask for passwords via email.

What should I do if I entered information on a phishing site?

Immediately change your password from the legitimate site and enable 2FA. If you entered credit card information, contact your card company to freeze the card.

Can I fall victim to phishing on a smartphone?

Yes. Smartphone URL bars are smaller, making fake sites harder to identify. SMS phishing (smishing) is also increasing. Avoid tapping suspicious links and use official apps instead.