How phishing works

A phishing message is a request wearing a costume: it wants you to click, reply, download or pay, and it is dressed up as your bank, your courier, your employer, so that request feels routine instead of dangerous.

Almost every one leans on the same four things, often together. Urgency — act in the next hour or something bad happens. Authority — this is your bank, your CEO, IT support. Fear or reward — your account is locked, or you have won something. And underneath all three, always, a request to act right now: click this link, open this file, reply with these details.

None of those four things is proof of an attack by itself — a real bank sometimes does need you to act quickly. What this lab teaches is not "does it sound urgent", it is evidence: does the sender’s address match who they claim to be, does a link actually go where its text says, do the authentication headers agree. Tone is a hint to look closer. Evidence is what decides.

Every message in this lab is simulated, from fictional companies, on domains that lead nowhere. The skill transfers directly: the same checks work on the real thing.