Phishing Attacks: Psychological Manipulation and Technological Countermeasures

Phishing is still one of the most common threats on the internet. It pairs psychological manipulation with technical deception, and the damage ranges from financial loss and identity theft to data breaches. This paper looks at both halves of the problem: how social engineers work on people through cognitive bias, emotion and trust, and what defenders have built to stop them. It follows phishing from basic email scams to multi-vector campaigns that run across SMS, voice calls, social media and spoofed websites, and it pays particular attention to India. The countermeasures covered are email authentication protocols (SPF, DKIM and DMARC), multi-factor authentication, AI-powered threat detection and domain monitoring, along with security awareness programmes and simulated phishing exercises. Drawing on academic and industry literature, the paper finds that no single control is enough. Attackers change their methods quickly and human attention has limits, so defence has to be layered, combining technology, continuous user education and supportive policy. The paper closes with possible future directions, among them AI-based behavioural analytics, blockchain-based authentication and biometrics.