Phishing is a fraud technique that steals personal and login information using fake websites, emails, and text messages that impersonate real companies or organizations. The name is usually traced to the English word "fishing," respelled with "ph." The Council of Anti-Phishing Japan received 1,196,390 phishing reports in Japan in 2023, the highest annual total in its records at that point, and 2,454,297 reports in 2025, the highest annual total in its records at that point. Attackers impersonated 229 brands in 2025, with credit card issuers and financial institutions making up the largest groups.
Phishing that revolves around phone numbers takes several forms. Smishing, which arrives by SMS, poses as a courier delivery notice or a bank security alert to steer the recipient to a fake site. Vishing (voice phishing) asks for personal details directly over the phone, often paired with caller ID spoofing so that the call appears to come from a bank or the police. A phone number harvested through phishing can also become the foothold for a SIM swap attack, so a single leak tends to feed the next attack.
There is a limit to how far you can get by judging a site on its appearance. Domains that differ from the genuine one by a single character, emails sent under the name of a real employee, and fake sites carrying an SSL/TLS certificate so the browser shows a padlock have all been reported, and none of them fail the usual "does this look suspicious" test. The more reliable habit is to never enter credentials on a page you reached by following a link.
Practical defenses include never clicking a suspicious link, reaching a service through its official app or your own bookmark rather than a link in an email or SMS, turning on two-factor authentication, and using a password manager (it will not auto-fill on a fake site because the URL differs, which is itself a warning sign). A passkey (FIDO2) ties the credential to the domain it was registered for, so authentication does not succeed on a fake site at a different URL. See also bank transfer fraud prevention.