Phishing

It began on AOL in the United States in 1995-96, when teenagers using the 'AOHell' toolkit sent fake messages posing as AOL staff to steal passwords; the word 'phishing' was first recorded on the alt.2600 newsgroup on 2 January 1996.

The word 'phishing' was first recorded in January 1996 on the Usenet group alt.2600, describing people who tricked AOL users into giving up passwords; the 1995 AOHell toolkit included a tool for this. In the 2000s phishing moved to fake bank and PayPal emails, and 'spear phishing' targeted named people at companies and governments. Smartphones brought SMS 'smishing' and voice 'vishing', and phishing-as-a-service kits such as 16Shop and LabHost let people with no skills run campaigns. Today generative AI helps make messages fluent and personalised, and phishing is still the most-reported cybercrime to the FBI.

The criminal sends a message by email, text, phone or social media that pretends to come from a trusted brand, bank, employer or government office. It creates urgency, such as a locked account, missed delivery or unpaid fine, and pushes the victim to click a link to a fake login page or open a harmful attachment. Details entered on the page, including passwords, card numbers and one-time codes, go straight to the criminal, who uses them to take over accounts or steal money.

It is the cheapest attack there is: kits from services such as LabHost sold for a few hundred dollars a month, and one campaign can hit millions of inboxes. It works often enough to matter: the human element featured in about 60% of breaches and phishing in about 14% in Verizon's 2025 DBIR, and it was the most-reported crime to the FBI in 2025 with 191,561 complaints. It is low-risk because operators are abroad and each victim loses a small sum, so police target platforms (LabHost, 37 arrests in 2024) rather than individual senders.

Direct phishing losses reported to the FBI were $215.8 million in 2025, but phishing is also the entry point for BEC ($3.05 billion) and many ransomware attacks. The largest single case is again Rimasauskas's $121 million spear-phishing of Google and Facebook. Beyond money, stolen logins have exposed government and corporate networks, and victims lose email, identity and time.