When the target is your login
What Is Credential Phishing?
Credential phishing is a phishing attack designed to steal login secrets such as usernames, passwords, verification codes or other authentication material by sending the victim to a fake or deceptive sign-in flow.
Credential phishing is narrower than phishing in general. The attacker's objective is authentication material: something that helps them sign in as you or complete an account-recovery flow. The most familiar version is a fake login page, but the same objective can involve one-time codes, push approvals or recovery information.
How a fake sign-in becomes account access
- 1
The message creates a reason to authenticate
A document share, mailbox warning, invoice, invitation or security alert tells the recipient they must sign in.
- 2
The link leads to an attacker-controlled flow
The page may imitate a real provider closely enough that the victim focuses on the task rather than on the hostname.
- 3
The victim enters authentication material
The attacker captures a password and may immediately ask for a second factor, recovery code or approval to complete the sign-in.
- 4
The attacker replays what can be replayed
Passwords and many traditional codes can be entered into the real service. Some attacks proxy the real login in real time so the victim sees a plausible workflow while the attacker steals the resulting session.
What attackers may try to steal
| Authentication item | Why it matters | Key limitation |
|---|---|---|
| Password | Can unlock the target account and may be reused on other services | Unique passwords limit damage from reuse |
| SMS or app code | Can complete a traditional second step during an active phishing session | Codes expire, but real-time phishing can still capture them |
| Push approval | Can authorize a login the victim did not initiate | Context-aware prompts and user refusal can break the attack |
| Recovery code | May bypass the normal second-factor path | Recovery material should be treated like a high-value credential |
| Passkey | The private credential is bound to the legitimate site | FIDO2/passkeys are designed to resist ordinary phishing replay |
Why passkeys change this specific attack
Traditional phishing succeeds partly because a human can type a reusable secret into the wrong website. FIDO2 credentials, including passkeys, are designed around public-key cryptography and origin binding rather than handing a reusable secret to the page.
The NCSC now recommends passkeys over passwords where available and assesses FIDO2 credentials as phishing-resistant. That does not make the entire account invulnerable: recovery flows, compromised devices and other attack paths still matter.
Reduce credential-phishing risk
- Use passkeys where your provider supports them.
- Otherwise use a unique password plus 2-step verification rather than password-only login.
- Do not enter credentials through an unexpected email link when you can open the service independently.
- Never share a verification or recovery code simply because a message says support needs it.
- Review login alerts and active sessions if you think you entered credentials into the wrong site.
Credential phishing is phishing with a precise target: the material that proves you are you. Stronger authentication helps most when it removes reusable secrets from the attacker's reach instead of merely making those secrets harder to guess.
Put this threat in context
Sources and further reading
Need a separate inbox for a short-lived interaction?
Temporary email can reduce exposure of your durable address when future recovery is not important. It is one privacy layer, not a replacement for account security.
Create temporary email