Explain
Phishing in terms of a fake parcel text
Phishing is just a DPD delivery text from a man who has never actually met your front door.
At its core, phishing is an exercise in manufacturing a false crisis that requires you to tap a blue link before you have time to finish your morning tea. You are the homeowner, the scammer is the delivery driver, and your bank details are the parcel that is mysteriously trapped in a warehouse in Slough because you apparently forgot to pay a 72 pence shipping fee. It is the digital equivalent of a stranger knocking on your window at 3am to tell you your bin is on fire, but if you just give them your credit card number, they will go fetch a bucket.
The beauty of the con is that it relies on the same psychological impulse as waiting for a Saturday morning delivery of a slightly embarrassing gadget. The message creates a sense of crushing urgency that overrides your common sense, much like the blind panic of seeing a missed call from your own mother. You click the link, and suddenly you are on a website that looks exactly like a real parcel portal, except the logo is slightly pixelated and the 'Track My Item' button leads to a form asking for your mother's maiden name and your third-year primary school teacher.
By the time you realise your package does not exist, the scammer has already moved on to harvest the details of someone who actually believes they are winning a free Dyson. It is a performance of bureaucratic incompetence designed to make you feel helpful, despite the fact that you have never ordered anything from a company based in an unspecified European country. It turns out the only thing being delivered is a lifetime of password resets and a very awkward conversation with your bank manager.
Where the analogy breaks downActual parcel scammers never give you back the 72 pence you spent on the fake postage.