The lure, the line, and the hook¶

Phishing is the art of getting someone to do something they wouldn’t do if they stopped to think about it. The goal is to prevent the stopping and the thinking. A good lure creates just enough urgency, plausibility, and familiarity that the target’s instinct to act outpaces their instinct to question. It doesn’t need to be perfect. It needs to be good enough for the three seconds before someone clicks.

The delivery mechanisms have multiplied considerably. Email remains the workhorse, but SMS, voice calls, QR codes, and hybrid approaches that combine several of these have become standard practice. Each channel has its own psychological texture and its own set of defences to route around.