How Today’s Most Common Cyberattacks Work

Most cyberattacks on ordinary people and small businesses are not elaborate hacks. They are tricks that persuade someone to hand over a password, approve a login, install something or send money. Understanding how the common ones work makes them much easier to recognize. The FBI's Internet Crime Complaint Center receives hundreds of thousands of complaints each year, and phishing in its various forms is consistently among the most reported categories.

Each threat below is described in three parts: what it looks like, why it works, and what stops it.

Phishing emails and texts

What it looks like: a message that appears to come from a bank, a delivery company, a streaming service or your employer, asking you to log in, confirm details or pay a small fee. Text message versions are often called smishing.

Why it works: the fake login pages can be near-perfect copies, and the messages create urgency, such as a locked account or a missed parcel.

What stops it: never log in through a link in a message. Open the app or type the website address yourself. A password manager also helps, since it will not fill in your password on a lookalike domain.

Account takeover with reused passwords

What it looks like: someone logs into your email or shopping account without any phishing at all.

Why it works: billions of usernames and passwords from past data breaches circulate online. Attackers use automated tools to try those combinations on other sites, an approach known as credential stuffing. If you reused a password, one old breach can unlock many accounts.

What stops it: a unique password for every account, which in practice means using a password manager, plus two-factor authentication. You can check whether your email address appears in known breaches at the free service Have I Been Pwned.

MFA fatigue and code theft

What it looks like: a burst of login approval prompts on your phone that you didn't request, or a caller claiming to be from your bank who asks you to read out a code you just received.

Why it works: attackers who already have your password need the second factor. People approve prompts to make them stop, or trust a caller who seems to know their details.

What stops it: never approve a prompt you didn't trigger, and never share a one-time code with anyone. Where available, passkeys or a hardware security key resist phishing far better than text message codes.

Ransomware

What it looks like: files on a computer or network are suddenly encrypted, with a demand for payment to unlock them. Many groups also steal data first and threaten to publish it.

Why it works: it often starts with a phishing email, an unpatched system or remote access protected by a weak password. Hospitals, schools, local governments and small businesses are frequent targets because downtime is so costly.

What stops it: prompt software updates, two-factor authentication on remote access, and backups kept offline or in a separate account so they cannot be encrypted too. Test restoring from them occasionally.

Business email compromise

What it looks like: an email from a supplier announcing new bank details, or from a senior manager asking for an urgent transfer or gift cards.

Why it works: the email may come from a genuinely compromised account, so it looks entirely real. The FBI has repeatedly reported this as one of the costliest forms of cybercrime.

What stops it: confirm any change to payment details by calling a known phone number, never one supplied in the email. Require two people to approve large payments.

Fake apps, downloads and browser extensions

What it looks like: a free version of paid software, a "required" video player, a browser extension that promises coupons, or a search ad that leads to a convincing copy of a popular download page.

Why it works: the program may do what it says while quietly stealing saved passwords and browser cookies, which can let attackers into accounts without a password.

What stops it: download software only from the developer's own site or official app stores, be wary of sponsored search results, and review your browser extensions occasionally, removing any you don't use.

Unsecured home devices

What it looks like: nothing at all. Routers, cameras and smart devices with default passwords or old firmware can be taken over quietly and used to attack others.

What stops it: change default passwords, turn on automatic updates and replace routers that no longer receive security updates from the manufacturer.

If something gets through

Change the password on the affected account from a device you trust, sign out of all sessions, and turn on two-factor authentication. If money is involved, call your bank immediately. In the US, cybercrime can be reported at ic3.gov, and identity theft at IdentityTheft.gov, which provides a recovery plan.