What is phishing and why do we keep falling for fake messages?

Published on 2026-10-17 by frfrand

Cómo funcionan los intentos de phishing, ejemplos habituales y consejos prácticos para reconocerlos sin depender solo del candado HTTPS.

You receive an email saying your account will be suspended in ten minutes. It has the correct logo, a blue button, and even a fairly professional tone. You click the link and a login screen almost identical to the original appears.

That could be phishing: an attempt to trick you into giving information, money, or an action that benefits the attacker. Often it does not need to exploit a system flaw; it tries to take advantage of our trust, haste, or distraction.

How does it really work?

The attacker prepares a message that appears to come from someone known: a bank, a store, a server provider, or a coworker.

The message tries to provoke a quick decision. It may say there was an unusual charge, that an invoice expired, or that an account must be validated urgently. When the person follows the instructions, they may end up handing over a password, approving access, or downloading a malicious file.

The most important part of the attack is usually the story it tells you, not the technology used.

An everyday example

Imagine you receive a message from the supposed service where your website is hosted: "Your server will be deleted today; log in to prevent it."

The design looks legitimate, but the link leads to a slightly different domain. If you type your password there, the information goes to the operator of that page and not to the authentic provider.

This does not mean that all urgent notices are false. It means that urgency should not replace verification.

How to recognize a suspicious signal?

• They pressure you to act immediately or threaten exaggerated consequences.
• The sender, link, or domain does not match the real service.
• They ask for passwords, verification codes, or data that normally should not be requested via message.
• There is an unexpected file or a strange change in payment data.

A careful attacker can avoid spelling mistakes and use a very credible appearance. That is why it is not wise to base the entire analysis on whether the email "is well written."

What about the HTTPS padlock?

This is a very common confusion. The padlock indicates that the connection uses encryption and that some connection verification with the site has been performed. It does not prove that the page owner is honest. A fraudulent website can also have HTTPS.

It is better to check the site address and, if in doubt, open a new tab to enter by typing the address you know or using a saved bookmark.

What do I do if I already entered my password?

Enter through the legitimate page, change the compromised credentials, and close active sessions when the service allows it. If you reused that key, change it also in the other affected accounts.

Enable multifactor authentication and review movements, email rules, connected devices, or administrative changes. If it is a business account, notify the security team so they can review the scope.

What does it have to do with ArduMaker?

If you manage servers and applications from ArduMaker, protect access to your account as you would with any infrastructure panel: verify the domain before logging in, avoid sharing credentials, and distrust unexpected requests asking to modify permissions.

The key takeaway: phishing is tricking a person into giving up something they shouldn't share. The best defense starts by verifying who is asking for what, not by trusting the appearance of the message.