Where the name came from, how it evolved, and what happens when passwords disappear
Phishing is the oldest trick on the internet that still works. It has outlived dial-up, floppy disks, Internet Explorer and the fax machine. It survived spam filters, then two-factor codes, and it is currently in the middle of adapting to fingerprint logins and passkeys.
It survives because it doesn’t attack technology. It attacks the person using it.
Here’s the full story: where the word came from, how the attacks changed decade by decade, where things stand in Australia right now, and what phishing is likely to look like once passwords are gone.
What phishing actually is
Phishing is any attempt to trick you into handing over something valuable — a password, a code, a card number, a payment, or access to an account — by pretending to be someone you trust.
That’s the whole definition. Everything else is packaging.
The packaging is what changes. In 1995 it was an instant message from “AOL Billing”. In 2010 it was an email from your bank. In 2020 it was a text about a missed parcel. In 2026 it might be a phone call from someone who sounds exactly like your daughter, or a QR code taped over the real one on a parking meter.
The ask underneath never changes: do something now, without checking.
Where the name comes from
The word is a deliberate misspelling of fishing — you cast out bait, you wait, some proportion of people bite.
The odd ph spelling is a borrowed piece of hacker heritage. In the 1970s and 80s, people who explored and exploited the telephone network called it phreaking, and called themselves phreaks. When that crowd moved online, they brought the spelling with them. Phreaking became phishing.
The word appears to have been coined in January 1995, inside a piece of software called AOHell, written by a teenager who went by “Da Chronic” (later identified as Koceilah Rekouche, who has since written an academic account of the period). AOHell was a free toolkit for messing with America Online, the biggest internet provider of the day, and it included a point-and-click system for stealing passwords and credit card details. It even had a Help button explaining how to do it, so that people with no technical skill could join in. Both spellings — fishing and phishing — appear in the program’s own interface.
The first recorded public use of the word came a year later, on 2 January 1996, in an AOL discussion newsgroup.
So phishing wasn’t invented by organised crime. It was invented by teenagers, and it was democratised from day one — the toolkit came with instructions.
1995–2000: the AOL years
The original scheme was almost quaint.
AOL charged by the hour, so free access was worth stealing. Attackers first generated fake credit card numbers to open accounts. When AOL closed that hole by actually verifying cards, the attackers pivoted to the far more reliable method: just ask people for their password.
They’d sit in chat rooms, message members directly, and say something like “Hi, this is AOL Customer Service, we need to verify your billing information.” Enough people complied that it became an industry.
Two lessons were established in those first five years, and both still hold:
- Impersonating a trusted brand works better than any technical exploit.
- When you close a technical door, attackers move to the human one.
2000–2010: following the money
Once real money moved online, phishing followed it. Banks, payment processors and early digital-currency services became the targets, and the format settled into the one most people still picture: a mass email, a spoofed logo, an urgent warning about your account, and a link to a fake login page.
This is the era that gave phishing its reputation for being obvious. Bad grammar, strange spacing, a Nigerian prince, a padlock that wasn’t there. A generation of workplace training was built on “look for the spelling mistakes.”
That training has aged badly, and we’ll come back to why.
Two other things started here that mattered enormously later:
- Spear phishing — instead of a million generic emails, one carefully researched email aimed at one person, using real names, real projects and real context scraped from the web.
- Business email compromise — impersonating a supplier, a CEO or a conveyancer to redirect a legitimate payment into the wrong bank account. No malware, no hacking, just a convincing email and a changed set of bank details.
2010–2020: it moves off email
Phishing spread to every channel a message can arrive on:
- Smishing — SMS. Missed parcels, toll notices, myGov refunds, bank alerts. Devastatingly effective because scam texts could be made to appear inside the same message thread as genuine ones from the real organisation.
- Vishing — voice calls. “This is your bank’s fraud department, we’ve detected a suspicious transaction.”
- Social phishing — fake support accounts on Facebook and X that reply to anyone complaining about a company.
- Ad and search phishing — buying an ad so the fake login page sits above the real one in search results.
The “look for spelling mistakes” advice quietly stopped working, and the padlock icon stopped meaning anything at all — free certificates meant scam sites got padlocks too.
Meanwhile, multi-factor authentication arrived and genuinely helped. For a few years, a stolen password on its own became close to useless.
Attackers adapted, as they always do.
2020–now: stealing the session, not the password
This is the shift most people haven’t caught up with, and it’s the single most important thing in this article.
Modern phishing kits often don’t try to steal your password at all. They steal your already-logged-in session.
The technique is called adversary-in-the-middle. Instead of building a fake copy of a login page, the attacker’s server sits invisibly between you and the real one, passing everything through:
- You click the link and see the genuine Microsoft or Google login page, because it is the genuine page, relayed.
- You type your real password. It’s forwarded to the real service.
- You get a real MFA prompt on your phone. You approve it, correctly.
- The real service issues a session cookie — the token that proves you’re logged in.
- The attacker catches that token in transit and loads it into their own browser.
You end up logged in. Everything looked right, because everything was right. And the attacker is now inside your account without ever needing your password or your code again.
Tools that do this — Evilginx, Tycoon 2FA, EvilProxy, Mamba 2FA — are rented as a service for a few hundred dollars a month. Microsoft reported a 146% increase in adversary-in-the-middle attacks across 2024, and by mid-2025 a single kit, Tycoon 2FA, reportedly accounted for the majority of the phishing volume Microsoft was blocking.
Layered on top of this, in the last two years:
- AI-written lures. Bad grammar is no longer a signal of anything. A scam email in 2026 can be flawless, in your language, referencing your industry, your employer and your recent LinkedIn post.
- Voice cloning. A few seconds of audio is enough to imitate a specific person’s voice — a boss, a colleague, a family member.
- Live, guided attacks. Rather than sending a link and hoping, an attacker phones you, poses as IT support or your bank, and talks you through the fake page step by step while controlling what you see.
- Quishing. QR codes in emails, on posters, on parking meters and stickered over legitimate ones — because a QR code hides its destination and moves the victim onto a phone, which is harder to protect and easier to fool.
Where it stands in Australia
The picture in Australia is genuinely mixed — some good news, some not.
According to the National Anti-Scam Centre’s Targeting Scams report published in March 2026, Australians made 481,523 scam reports in 2025, with 274,577 of those involving a financial loss, totalling $2.18 billion. That’s up 7.8% on 2024 — but still around 30% below the 2022 peak of $3.1 billion.
Phishing specifically:
- Phishing was the most reported scam type to Scamwatch in 2025, with 65,361 reports.
- Direct phishing losses were $97.6 million, the fourth-largest category by loss.
- That figure undersells it. Payment redirection scams — $166.8 million, second on the list — are almost entirely phishing-driven, and the initial break-in for a business email compromise is usually a phished inbox.
- Australians aged 65 and over make up about 17% of the population but around 26.5% of reported Scamwatch losses.
- SMS scam contact reports fell sharply — from 77,365 in 2024 to 29,058 in 2025 — which is what successful intervention looks like.
That last point connects to something new. Since 1 July 2026, Australia’s SMS Sender ID Register has been in force. Businesses must register the branded name that appears at the top of their texts. Messages sent from an unregistered branded sender ID are now relabelled “Unverified” and bundled into a separate thread on your phone.
In practice: if a text claims to be from myGov, AusPost or your bank and it turns up under “Unverified” or in a thread by itself, treat it as a scam until proven otherwise.
What happens when the password disappears
Passwords are on the way out. Passkeys — where you log in with a fingerprint, face scan or device PIN instead of typing a secret — are supported on the overwhelming majority of phones and computers now, and the big platforms are pushing hard. Microsoft has said that from September 2026 it will start automatically nudging users who rely on SMS or voice codes to register a passkey instead.
Passkeys genuinely do break classic phishing, and it’s worth understanding why, because it’s elegant.
A passkey is cryptographically bound to the exact domain it was created for. Your browser and device check the domain before releasing the response. A fake login page — even a perfect pixel-for-pixel replica, even one relaying the real page — is on a different domain, so the handshake simply fails. There is no code to read out, no password to type, nothing to hand over. The user can’t be tricked into giving away something they never possess.
This is real progress. So it’s worth being clear-eyed about what it doesn’t fix.
Phishing doesn’t die. It relocates. Security researchers are already documenting where:
- Account recovery. If you can’t phish the login, phish the “I lost my phone” process instead. Recovery flows often still fall back on email, SMS or security questions — all phishable.
- The help desk. An attacker with enough personal detail phones support, plays a locked-out customer or employee, and talks a human being into resetting the account or enrolling a new device. Nothing is hacked. The account is handed over through the front door.
- Downgrade attacks. If a password still exists as an emergency backup, the account is still only as strong as that backup. Attackers will engineer situations where you fall back to the weaker method.
- Enrolment phishing. Okta’s threat intelligence team reported attackers phoning targets and walking them through a fake passkey setup page — using the security upgrade itself as the pretext. The nudge to “please register a passkey” is now a scam script.
- The cloud account holding your passkeys. Synced passkeys are convenient, but they concentrate risk: compromise the Apple, Google or Microsoft account they sync through, and you may be able to restore them elsewhere.
- Consent and approval phishing. Rather than stealing a login, trick you into granting permission to a malicious app that then reads your mail indefinitely.
- Everything that was never a login problem. Romance scams. Invoice fraud. Fake investment platforms. Marketplace scams. None of these care what your authentication looks like — they persuade you to send money voluntarily.
The pattern from 1995 repeats exactly: close the technical door, and the pressure moves to the human one.
The realistic forecast is that phishing becomes less about links and more about conversations — fewer dodgy emails, more phone calls, more live-guided manipulation, more attacks on recovery and support processes, and more use of synthetic voice and video to establish trust in the first thirty seconds.
What actually protects you
Short version, in rough order of impact:
- Turn on passkeys wherever they’re offered — especially on your email account, because email is the master key to everything else.
- Treat any unexpected contact as unverified, no matter how it arrives or who it appears to be from. Not suspicious — just unverified, until you check.
- Go to the organisation yourself. Never through the link, the number, or the QR code in the message. Type the address, use the official app, or use the number on the back of your card.
- Slow down when you feel urgency. Manufactured time pressure is the one ingredient present in nearly every phishing attempt ever made. Feeling rushed is the red flag.
- Never read out a code. No legitimate organisation will ever ask you for a one-time code, ever, for any reason.
- Set a family or team code word for anything involving money or emergencies. Voice cloning has made “it sounded like them” worthless.
- Watch for “Unverified” on texts now that the Sender ID Register is live.
- Assume the fallback is the weak point. Check what happens on your important accounts if you claim to have lost your device — that’s the door attackers will try.
If you’ve been caught
Something worth saying plainly, because it comes up constantly in this community:
Getting phished is not a sign that you’re stupid, careless or old. It’s a sign that a professional, well-funded, endlessly iterating industry got you on a day when you were busy, tired, or expecting exactly that kind of message. These campaigns are tested on millions of people and refined until they work. The shame people feel afterwards is the single biggest reason scams go unreported — which is precisely what keeps them profitable.
If it’s just happened, move fast on the first hour: change the password on the affected account from a different device, revoke active sessions, contact your bank immediately if money or card details are involved, and check whether the account can be used to reset anything else.
Where to report in Australia:
- Scamwatch (National Anti-Scam Centre / ACCC) — report a scam and check current alerts
- ReportCyber — report cybercrime to Australian law enforcement
- eSafety Commissioner — online abuse, image-based abuse and cyberbullying
- ACMA — SMS Sender ID Register — how branded and “Unverified” texts now work
Phishing has been running for thirty-one years and it has never once needed a new idea. It just keeps finding new doors.
Over to you: what’s the most convincing phishing attempt you’ve ever received? Or the one that nearly got you? Sharing the near-misses is genuinely useful — the specifics of what made it convincing are what help the next person spot it.