---
title: "Not All Phishing Attacks Come by Email | DuoCircle"
description: "Most phishing attacks are pretty straight forward. They try to get the login credentials to your bank account, wipe you out and go on vacation."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/phishing-protection/not-all-phishing-attacks-come-by-email/"
---

Quick Answer

Phishing also arrives by phone. Lifehacker documented a case where attorney Pieter Gunst got a call claiming to be from his bank, asking about a suspicious transaction. He gave a non-sensitive customer number, then read back a verification PIN the caller said was sent by the bank, not realizing the attacker was using that code to reset his account password. The scam unraveled only when the caller asked for his card PIN to set up a 'fraud alert,' at which point Gunst hung up and called the fraud department directly. The rule the post gives: never give a PIN over the phone, and call the institution back at a known number rather than trusting an inbound call. For phone phishing, common sense is the only control. For email phishing, real-time link scanning catches the link before the user does.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fnot-all-phishing-attacks-come-by-email%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Not%20All%20Phishing%20Attacks%20Come%20by%20Email&url=undefined%2Fblog%2Fphishing-protection%2Fnot-all-phishing-attacks-come-by-email%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fnot-all-phishing-attacks-come-by-email%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fnot-all-phishing-attacks-come-by-email%2F&title=Not%20All%20Phishing%20Attacks%20Come%20by%20Email "Share on Reddit") [ ](mailto:?subject=Not%20All%20Phishing%20Attacks%20Come%20by%20Email&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fnot-all-phishing-attacks-come-by-email%2F "Share via Email") 

![Phishing Attacks](https://media.mailhop.org/duocircle/images/2019/10/spf-record-7371.jpg) 

Most phishing attacks are pretty straight forward. _They try to get the login credentials to your bank account, wipe you out and go on vacation_. I’m not really sure about the vacation part, but the rest is pretty typical.

What else is typical is that the way to get your credentials is to send you an **email with a link** to a bogus website that captures your information and looks convincing enough so that you’ll provide it. _Phishing attacks mostly come by email, but not always_.

According to a Lifehacker [article](https://twocents.lifehacker.com/beware-a-new-scam-that-asks-for-your-bank-pin-on-the-ph-1838909542), a lawyer was the target of a phishing attack **over the phone** recently. _The lawyer outlined the steps the hacker took to get his credentials, including PIN. And he almost got away with it_.

[![Phishing Attacks](https://media.mailhop.org/duocircle/images/2019/10/spf-record-7372.jpg)](https://media.mailhop.org/duocircle/images/2019/10/spf-record-7372.jpg)

From the article, the lawyer, Pieter Gunst, “_got a call from someone claiming to be from his bank, asking him if he had used his card in a far-away city_. When he said he hadn’t, the caller blocked the transaction and asked for Gunst’s member number, which he explained in the thread is a customer number, not a bank account number.

The person on the phone said they were sending a **verification PIN** that Gunst read back after receiving from the phone number he associates with his bank. _He later realized that the scammer was resetting his password with the verification number they sent to Gunst’s phone_.

The scammer read off a few other charges, Gunst confirmed he had made them, and the scammer said, ‘Thank you! We now want to block the PIN on your account, so you get a fraud alert when it is used again. What is your PIN?’ That’s _when Gunst knew for sure that something was up. He hung up and called his bank’s fraud department directly_. Giving out his PIN would have allowed the scammer to withdraw money from his account, had he not realized something was amiss.”

[![prevent phishing attacks](https://media.mailhop.org/duocircle/images/2019/10/spf-record-7373.jpg)](https://media.mailhop.org/duocircle/images/2019/10/spf-record-7373.jpg)

_Never give out a PIN over the phone. Better yet, never trust anyone that calls you on your phone. Call them instead._

You now see that not all phishing attacks come via email, although most do. There’s not much you can do to **prevent phishing attacks** over the phone other than to use common sense. But _there’s a lot you can do to protect yourself from phishing attacks that arrive via email._

[DuoCircle](/email/phishing-protection) protects your from more common phishing attacks that arrive via email. It provides the most important [phishing protection](/email/phishing-protection) of all: real-time link scanning. It sets up in 10 minutes, costs pennies per month per account and comes with 24/7 live technical support.

When phishing attacks arrive on the phone, just hang up. When they arrive via email, protect yourself with [DuoCircle.com](/)

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

## Related Articles

[  Phishing 11m  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough  Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[  Phishing 5m  10 Applications of ChatGPT that Hackers Are Already Exploiting  May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[  Phishing 4m  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks  Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[  Phishing 9m  7 Ways to Protect Your Organization from Email-based Ransomware Attacks  Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Not All Phishing Attacks Come by Email","description":"Most phishing attacks are pretty straight forward. They try to get the login credentials to your bank account, wipe you out and go on vacation.","url":"https://www.duocircle.com/blog/phishing-protection/not-all-phishing-attacks-come-by-email/","datePublished":"2019-10-18T16:52:38.000Z","dateModified":"2025-05-28T13:03:29.000Z","dateCreated":"2019-10-18T16:52:38.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/not-all-phishing-attacks-come-by-email/"},"articleSection":"phishing-protection","keywords":"","wordCount":452,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/10/spf-record-7371.jpg","caption":"Phishing Attacks","width":868,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"Not All Phishing Attacks Come by Email","item":"https://www.duocircle.com/blog/phishing-protection/not-all-phishing-attacks-come-by-email/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Not All Phishing Attacks Come by Email","item":"https://www.duocircle.com/blog/phishing-protection/not-all-phishing-attacks-come-by-email/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"Not All Phishing Attacks Come by Email","description":"Most phishing attacks are pretty straight forward. They try to get the login credentials to your bank account, wipe you out and go on vacation.","url":"https://www.duocircle.com/blog/phishing-protection/not-all-phishing-attacks-come-by-email/","datePublished":"2019-10-18T16:52:38.000Z","dateModified":"2025-05-28T13:03:29.000Z","dateCreated":"2019-10-18T16:52:38.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/not-all-phishing-attacks-come-by-email/"},"articleSection":"phishing-protection","keywords":"","wordCount":452,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/10/spf-record-7371.jpg","caption":"Phishing Attacks","width":868,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```