Phishing schemes use sophisticated techniques to disguise the origin of spam emails and of fictitious websites, making it hard for the consumer to detect that they are fraudulent.

Often these criminals exploit the Uniform Resource Locator (URL) "user authentication" syntax feature supported by some Internet browsers to cleverly disguise the fictitious website as an authentic site. Doing so deceives the consumer because the fictitious website's URL, which is displayed in the Internet browser's address bar, matches that of a genuine website.

In some phishing instances, criminals will request that the consumer download and install "security" software which is attached to the spam email. If the consumer installs the software, the criminals can monitor the victim's computer and capture information such as bank, email and computer account details. The use of this mechanism, though low in relation to other mechanisms, has recently shown an increasing trend. In addition, these criminals can "take over" unsecured computers and servers using them to route spam email to conceal the real email source, as well as for launching spam e-mail distribution; all without the victim's knowledge.