Phishing is a scam where attackers impersonate trusted brands to trick people into handing over passwords and account access.

Where did Phishing come from?

The word first appeared in the 1994 AOL hacking tool AOHell, and the term is usually credited to hacker Khan C. Smith in the early 1990s.

What does Phishing mean?

The name is a hacker respelling of 'fishing,' following the 'phreaking' convention, with attackers casting a lure and victims cast as the fish.

How do you use Phishing?

Attackers send messages that look like they come from real banks or platforms and route victims to fake login pages that capture their credentials.

Is Phishing still popular?

Phishing is still widely reported, with variants like smishing and spear phishing keeping the format effective, as shown by the viral 2017 Google Docs attack.

Phishing

1994termclassic

Published September 20, 2026

Phishing is a social engineering scam where attackers impersonate banks, tech companies, or coworkers to trick people into handing over passwords and account access. The word first appeared in the 1994 AOL hacking tool AOHell and grew into one of the defining forms of internet fraud, from Russian botnet operations to the viral 2017 Google Docs email attack.

scam memes hacking memes cybersecurity memes crime memes hoax memes

Overview

Phishing works by baiting targets with familiar-looking messages, then routing them to look-alike login pages that harvest their credentials1. The 'ph' spelling follows the old hacker convention seen in 'phreaking,' and the metaphor casts the target as a fish taking a lure7. Common formats include fake bank fraud alerts, spoofed shipping notices, and 'someone shared a document with you' emails pointing to domains that mimic real brands.

Attackers copy real corporate email layouts, register visually similar domains, and rely on urgency such as 'your account will be suspended' wording to short-circuit careful reading7. Later variants added SMS ('smishing'), voice calls ('vishing'), and targeted spear phishing tied to specific individuals or companies, but the core trick of impersonating a trusted sender is still the same.

Origin & Background

Platform

AOL (via AOHell tool)

Date

1994

A 1987 presentation at the International HP Users Group described the technique before it had a name, and the term itself is usually credited to hacker Khan C. Smith in the early 1990s. The earliest archived use appears in AOHell, a 1994 Windows tool that automated attacks on America Online accounts and included a built-in function for stealing passwords5. The 'ph' spelling followed the older 'phreaking' convention used by phone-system hackers7.

How It Spread

The first documented phishing attempt against a payment system hit the digital gold service E-Gold in June 2001, and by 2003 The Banker was reporting on the first known attack against a retail bank5. Financial fraud losses climbed sharply through the mid-2000s, and Reddit's /r/phishing subreddit opened on June 14, 2008 as a discussion space for scam analysis5.

Explainer videos and parodies followed the news coverage. On August 21, 2013, YouTuber Cyber51Security posted a literal demonstration that fished a bag labeled 'user name / password' out of a bucket labeled 'Internet'3. Minutephysics broke down a sophisticated YouTube phishing attack on April 30, 20144, and Trend Micro released the 'Phishing Scams, Don't Be That Guy' parody ad that October6.

The best-known modern incident hit Google Docs in early May 2017, when victims got fake sharing invitations that granted attackers full mailbox access. Zach Latta's May 3, 2017 tweet showing the fraudulent share prompt called the attack 'super sophisticated'2, and a Reddit post by user JakeSteam explaining the mechanics helped push Google to shut the spammer developer account within about 30 minutes.

Timeline

1994

The AOHell hacking tool for AOL contains a password-stealing function labeled 'phishing,' the earliest archived use of the term.

2001-06

The first documented phishing attempt against a payment system targets the digital gold currency service E-Gold.

2003

The Banker reports on the earliest known phishing attack against a retail bank.

2008-06-14

The /r/phishing subreddit launches as a discussion space for the scamming practice.

2013-08-21

YouTuber Cyber51Security posts a video demonstration fishing a 'user name / password' bag out of a bucket labeled 'Internet.'

2014-04-30

Minutephysics uploads a breakdown of a sophisticated YouTube phishing attack.

2014-10

Trend Micro releases the 'Phishing Scams, Don't Be That Guy' parody ad.

2017-05-03

Zach Latta tweets a viral clip of the Google Docs phishing attack; Google disables the spammer developer account within roughly 30 minutes.

Phishing

Overview

Origin & Background

How It Spread

Frequently Asked Questions

References (7)