In more detail
Typical signs are urgency, a link to a look-alike domain, an unexpected attachment and a mismatch between the displayed and real sender. Defences include checking the actual address, never signing in through an emailed link, Multi-factor authentication (MFA) (which limits what a stolen password gives) and DMARC on your own domain. A defanged URL, with dots and the scheme altered, is safe to share when reporting. Variants have their own names: spear phishing targets one person using details about them, whaling targets executives, smishing uses text messages, vishing uses phone calls and quishing hides the link in a QR code. All of them rely on Social engineering more than on technical tricks.
Why it matters
Phishing is the most common way into an account or a network, because it targets the person instead of the software. A single click on a fake login page can hand over a password, and a fake payment request can move real money before anyone notices. Filters stop a lot, but a well-made message to the right person still gets through, so the habit that matters is pausing before acting on a message that asks for credentials, payment or secrecy.
Example
A message arrives that looks like this:
From: "Example Bank Security" <[email protected]>
Subject: Your account will be closed in 24 hours
Three warning signs: urgency; the sender domain examp1e-bank.example swaps the letter l for the digit 1; and the display name is not the address. Rather than click the button, open the bank's site yourself. Look at the full header with the Email Header & Security Analyzer to see which servers really sent it, and defang any link before you report it with the URL Defanger.
Common confusion
Phishing is the delivery trick, not the payload. What a victim ends up running is Malware; what the attacker steals first is usually a password.