Phishing

Overview

Phishing ("fishing" for your passwords) is a scam that uses fake emails and websites pretending to be real services, such as banks, social media, and online shops, to trick users into giving away their login details or credit card numbers. The word comes from "fishing," from the image of using bait (a fake site) to reel in a target. According to a report by the Council of Anti-Phishing Japan, more than 2.45 million phishing reports were sent in from within Japan over the course of 2025, making it a cybercrime that many people run into in everyday life.

Typical phishing tricks

A typical trick is an email or text message (SMS) pretending to be from a real service. Messages that stir up a sense of urgency, such as "Your account has been used without permission," "We need to verify your identity," or "There is a problem with your payment," get you to click a link to a fake site. Fake sites are built to look exactly like the real thing, and unless you check the URL carefully, you can't tell them apart.

In recent years, the tricks have become more sophisticated. The variations keep growing: typosquatting, which uses strings that look like real domains (for example, amaz0n.com or g00gle.com); quishing (QR + phishing), which uses QR codes to lead you to fake sites; and spear phishing, which sends carefully crafted emails aimed at a specific person.

Phishing that question box users should watch out for

Question box owners are easy targets for phishing. If you post your question box URL on social media, that social media account is visible to attackers too. You may receive a phishing email pretending to be "an important notice from the question box service."

There are three points for telling them apart. First, check whether the sender's email address is from the real domain. Second, check whether the URL the link points to is on the real service's domain (hovering your mouse over a link shows the actual URL). Third, check whether it asks you to enter your password or credit card number. A real service will never ask you to enter your password by email.

How to protect yourself from phishing

The most effective defense is not to click links in emails or text messages directly. If you get a notice saying "there is a problem with your account," don't use the link in the email. Instead, go to the real site from your browser's bookmarks or a search engine and check there. This habit alone lets you avoid a lot of phishing.

As a technical defense, turning on two-factor authentication works well. Even if you do enter your password on a phishing site, an attacker can't log in as long as two-factor authentication is on. Using a password manager also helps: autofill doesn't work unless you're on the real domain, so it stops you from entering your details on a fake site. You should also always keep the phishing detection features of your browser and security software turned on.