Why do phishing emails still work on careful people?
They do not target carelessness — they target context, arriving at a moment when the request they make is exactly what you were expecting.
Simple intuition
The plain reason, in everyday words
The image of a phishing email as an obvious scam with bad spelling is out of date, and it makes people overconfident. A modern one arrives when you are expecting it: a delivery notification during the week you ordered something, an invoice in the middle of an actual project, a password reset minutes after someone triggered one on your account. The message does not have to be convincing in the abstract; it only has to be plausible for thirty seconds while you are busy. On top of that, the details you were taught to check are the easiest parts to fake. Anyone can copy a company's logo and wording exactly, sender names can be set to anything, and a link's visible text has nothing to do with where it goes. Careful people are caught by timing, not by ignorance.
Phishing emails are full of spelling mistakes and easy to spot.
Some are deliberately crude to filter for the most susceptible targets. Targeted attacks are well written, correctly branded, and often continue a genuine conversation.
The padlock icon means the site is genuine.
It means the connection is encrypted. Certificates are free and automated, so a phishing site has one too. It says nothing about who is on the other end.
Two-factor authentication makes you phishing-proof.
Codes you read and retype can be relayed in real time by an attacker's proxy, which modern kits automate. Only origin-bound credentials such as passkeys resist this by design.
Being careful is the main defence.
Care helps, but attacks are engineered for moments when care is spent elsewhere. Defences that do not depend on noticing — password managers refusing to autofill, passkeys, out-of-band verification of payment changes — do far more work.
It replaces a defence that fails under pressure — being alert — with ones that work while you are distracted. Two changes follow directly and cost nothing: let a password manager fill your credentials, so a wrong domain fails silently rather than depending on you reading it, and verify any change of payment details through a number you already had. It is also a good general lesson that when a system depends on people being consistently vigilant, the system is the problem.
Who worked it out
The term dates to the mid-1990s and AOL account theft, where attackers posed as staff asking users to verify billing details — the same social pattern used today.
What problem forced it
Email's lack of built-in authentication made impersonation trivial, and the retrofitted standards SPF, DKIM and DMARC verify the sending domain without preventing an attacker from registering a convincing one.
How it changed since
As passwords were supplemented by codes, phishing kits added real-time relaying to capture them. The response has been to remove the human from the verification step entirely, through the origin-bound credentials standardised as WebAuthn and now deployed as passkeys.
How passkeys replace passwords entirely
The server stores a public key, so there is no shared secret to steal and nothing to phish.
Why password reuse turns one breach into many
Credential stuffing is what makes a single leaked password expensive, and it is the other half of this problem.
Written for Curio rather than collected from a forum — it is part of the curated corpus that ships with the platform. The references it draws on are listed under Sources.