Kolade Akinwale Ojelade sent phishing emails to real estate businesses, got into their accounts and watched for large transactions, the US Attorney for the Northern District of Texas said on 1 November 2024. He then resent wiring instructions from spoofed addresses, changed to point at accounts he and his accomplices controlled. The actual loss was about $12 million; he was sentenced to 316 months.
What is a phishing attack?
Table 1. Phishing attacks at a glance.
| Question | Answer |
|---|---|
| Channel | Email, text message, phone call, social media message or a fake website |
| What is taken | Logins, card and bank account details, personal data, or a payment |
| What follows | Account takeover, a redirected payment, malware on the device |
| US law | Wire fraud and aggravated identity theft (Table 4) |
| UK law | Fraud by false representation, Fraud Act 2006, in England, Wales and Northern Ireland |
| Report to | US: IC3 at ic3.gov. UK: report@phishing.gov.uk |
Beside scams and theft in what fraud is, phishing is the one defined by its disguise. The NIST glossary calls it "a technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a web site, in which the perpetrator masquerades as a legitimate business or reputable person."
The Anti-Phishing Working Group adds the method: "both social engineering and technical subterfuge" (APWG, Q2 2026 report, 28 August 2026). A phishing scheme can be one email to millions of inboxes or a message written for one employee. Phishing for information such as a password "could be the first step in a targeted attack", warns the NCSC's guidance.
Is phishing a form of social engineering?
Yes. NIST's definition of social engineering is deceiving someone into revealing information, giving access or committing fraud by associating with them "to gain confidence and trust". Phishing does it by message, link or call. Social engineering uses aspects of human nature, trust above all; its life cycle runs from research to contact, trust and exit. Baiting offers something the target wants, and pretexting invents a reason to ask. With MFA, a stolen password alone does not open an account (NCSC).
How does a phishing attack work, step by step?
Table 2. The phishing process in the Ojelade case, stage by stage.
| Stage | What the fraudster did | What the victim or firm saw | Who can catch it |
|---|---|---|---|
| 1. Bait | Sent phishing emails to real estate businesses | An ordinary business email | Email filtering; the employee who reports it |
| 2. Hook | Gained unauthorized access to many of their accounts | Nothing; the login worked | IT, from an unusual login |
| 3. Watch | Monitored email traffic for large transactions | Nothing | Security logging |
| 4. Switch | Changed the wiring instructions and resent them from spoofed addresses | A familiar sender with new bank details | The payer, by calling back on a known number |
| 5. Cash out | Withdrew the funds or moved them to other bank accounts | A completed payment | The receiving bank |
Stages 2 and 3 are account takeover fraud: the criminal logs in with a real password, so nothing looks wrong. Stage 4 is the payer's last chance to stop it, by "confirming wiring instructions in person or by phone", as the US Attorney put it. In stage 5 the money reached accounts he and his accomplices controlled; other schemes use a money mule.
> "In the FBI's 2025 figures phishing tops the complaint count, 191,561 reports, but not the loss table: $215.8 million against $3.05 billion for business email compromise, so a fraud team should measure phishing by what the stolen access was used for next, not by the losses filed under its name," says Ufuk Gürdaş, Compliance Specialist.
What are the common types of phishing and social engineering attacks?
Table 3. Common types of phishing and social engineering attacks.
| Type | Channel | What the attacker does | Example |
|---|---|---|---|
| Email phishing | Sends one lure to many inboxes | An invoice "that needed urgent attention", carrying malware (NCSC case) | |
| Spear phishing | Email or text | Uses details about the company or employee to make the message convincing | Information about staff or the company used to make messages "even more persuasive and realistic" (NCSC) |
| Whaling | Spear phishing aimed at a senior target | A "big phish", such as a board member who has access to valuable assets (NCSC) | |
| CEO phishing | Email, phone | Poses as the chief executive to order a payment or data | See CEO fraud |
| Clone phishing | Copies a real message the target received and swaps the link or attachment | Illustrative: last week's delivery notice, resent with a new link | |
| Link manipulation and pharming | Email, web | Hides a fake address behind a real looking link, or redirects users to a fake website | A link to a lookalike domain such as "amazan.com" (CISA) |
| Smishing | Text message | Phishing by SMS or text | Texts telling staff their accounts were about to be deactivated (charges, C.D. California, 20 November 2024); up 40 percent from Q1 to Q2 2026 (APWG) |
| Vishing | Phone call | Phishing by voice call | Up 20 percent from Q1 to Q2 2026 (APWG) |
| Quishing (QR code phishing) | QR code | Puts a QR code where a link would be, so the scan opens a site that asks for personal and financial details | A QR code on an unsolicited package with no sender information; the FBI says it can also download malicious software that steals data from the phone (IC3 public service announcement, 31 July 2025) |
| Malware and ransomware attacks | Attachment or link | Installs software that steals data or locks systems | Linked websites "may contain malware (such as ransomware)" (NCSC) |
These phishing techniques differ in channel and target; the attack methods barely change: a trusted name, a reason to act now, and a link, attachment or payment request. In the California case the charges say some staff also approved a login request on their phones, so a second factor lowers the risk without ending it.
How is phishing different from spoofing, spam and account takeover?
Spoofing forges the sender; phishing is the request the forged message carries. The FBI's IC3 counts them as one crime type, "Phishing/Spoofing": unsolicited email, texts and calls "purportedly from a legitimate company requesting personal, financial, and/or login credentials". Spam is unwanted bulk mail; a phish is built to deceive. Account takeover is one thing a phish leads to, and impersonation fraud often uses phishing as its channel.
What are examples of phishing attacks, and what is their impact?
- AOHell, 1995. The first recorded example: its creator calls this AOL hacking program "where the word phishing was coined". From January 1995 it automated password and card theft (Rekouche, arXiv, 23 June 2011).
- Operation Phish Phry, 2009. Nearly 100 people were charged in the US and Egypt. The perpetrators had used stolen bank details to move about $1.5 million to bogus accounts (FBI, 7 October 2009).
- The NCSC case. Of 1,800 malware emails sent to a financial sector company, filtering stopped 1,750, 14 were clicked and the one infection that installed was contained.
Of IC3's 2025 phishing and spoofing complaints, 48,064 came from people aged 60 and over, and reported losses reached $215,843,126. The APWG counted 1,069,681 phishing attacks in Q2 2026, up 10.1 percent from 971,181 in January to March.
What are the warning signs of a phishing attempt?
CISA names the first four signs; the NCSC case and the Ojelade case add the last two.
- Urgent language that threatens "dire consequences" for a slow reply.
- A request for logins, card numbers or a payment.
- An untrusted shortened link.
- A sender address or link one letter off the real one.
- An unexpected attachment, like the NCSC case's urgent invoice.
- New bank details from a familiar sender, as at stage 4 in Table 2.
Good grammar no longer clears a message: with AI, "some emails will now have perfect grammar and spelling", CISA warns.
How do you detect, prevent and report phishing attacks?
The NCSC's four layers keep staff from being the only defense: make users hard to reach, help them spot and report phishing, limit the harm of a phish that gets through, and respond quickly. Protection from phishing attacks starts with DMARC, SPF and DKIM against spoofing of your domain.
Detecting a phish early depends on staff reports: for anti phishing monitoring, the NCSC suggests counting who reported a test email, not only who clicked. To prevent phishing scams on payments, call back on a known number before changing bank details. How fraud detection works goes further.
In the UK, forward suspicious emails to report@phishing.gov.uk (NCSC) and report a loss to Report Fraud on 0300 123 2040 or, in Scotland, Police Scotland on 101. In the US, file with IC3.
What does the law say about phishing in the US, the UK and the EU?
Table 4. Phishing law by jurisdiction.
| Jurisdiction | Rule | What it covers | Maximum | Report to |
|---|---|---|---|---|
| United States | 18 U.S.C. 1343, wire fraud | A scheme to defraud carried out by wire, radio or television communication in interstate or foreign commerce | Fine, 20 years, or both; fine up to $1,000,000, 30 years, or both if it affects a financial institution | IC3 at ic3.gov |
| United States | 18 U.S.C. 1028A, aggravated identity theft | Transferring, possessing or using another person's means of identification without lawful authority during a listed felony | 2 years, in addition to the sentence for that felony | IC3 at ic3.gov |
| United Kingdom (England, Wales, Northern Ireland) | Fraud Act 2006, section 2, fraud by false representation | A false representation, including one "submitted in any form to any system or device" | 10 years on indictment (section 1) | report@phishing.gov.uk; Report Fraud, 0300 123 2040 |
| United Kingdom (England, Wales, Northern Ireland) | Fraud Act 2006, section 6 and section 7 | Possessing, or making and supplying, articles for use in frauds | 5 years (section 6) and 10 years (section 7), on indictment | As above; in Scotland, Police Scotland on 101 |
| European Union | Directive (EU) 2019/713, Articles 6 and 7 | Fraud related to information systems and the tools for it; recital 13 names phishing | Member states set a maximum of at least 3 years for Article 6 (Article 9(4)) | Set by each member state; Ireland and Denmark are not bound (recitals 38 and 39) |
In the US and the UK, phishing is charged under general fraud rules. Ojelade pleaded guilty to wire fraud affecting a financial institution and aggravated identity theft. Sections 1 to 9 of the Fraud Act 2006 extend to England and Wales and Northern Ireland only (section 15).
Which team owns a phishing loss, fraud or AML?
Both, at different ends: fraud owns the login and the outgoing payment, AML the account that receives the money. In one San Francisco case, staff wired $922,445.34 to a fake company after an email posing as a real service provider. George Aboagye pleaded guilty to laundering it (US Attorney, N.D. California, 17 July 2025). The bank holding that account is the one placed to file a suspicious activity report.
On the fraud side, complead, formerly Sanction Scanner, reads the device and the session from before login to the moment of payment with its device fraud and behavior analysis. Each score names its signals, and an analyst can step up, hold or block the session.
Three jobs for this week: set up DMARC on every sending domain, require a call back on a known number before anyone changes a payee's bank details, and check that staff know the report button and, in the UK, report@phishing.gov.uk.
Related terms
- Account takeover fraud. Control of a real account through stolen credentials.
- CEO fraud. A criminal poses as an executive to get staff to pay.
- Impersonation fraud. Posing as a trusted person or body.
- Money mule. A person whose account moves other people's criminal proceeds.
- Identity fraud. Using another person's name or personal details without permission.
- Cyber fraud. Fraud carried out online or through computer systems.
