Phishing vs pharming: with phishing, somebody has to talk you into going to the fake site, usually with a link in an email or a text. With pharming nobody needs to talk you into anything. You type your bank’s address yourself, spelled perfectly, and you still end up on a copy, because something between your keyboard and the bank has been tampered with.
That’s the whole difference, really. One goes after your judgment. The other goes after the plumbing underneath, so your judgment never gets a say.
| Phishing | Pharming | |
|---|---|---|
| How you end up on the fake site | You click a link or follow instructions in a message | You’re redirected, even if you type the correct address |
| What gets tampered with | Nothing technical; it relies on persuasion | DNS records, a router, or a computer’s hosts file |
| What the attacker needs | Your email address or phone number | Access to DNS settings, a router or your device |
| Can a careful user spot it? | Sometimes, by checking the link and sender | Rarely; the address bar can look right |
| Mostly stopped by | Filters, user checks, phishing-resistant MFA | DNS security, router and device hardening, monitoring |
Key takeaways
Type in your bank’s address and, before anything loads, your computer has to ask a DNS server which machine that name belongs to. A phone book, more or less. Pharming means someone has scribbled a wrong entry into that book. It might be on a DNS server out on the internet, on the router in your hallway (a lot of those still have the factory password), or in a tiny file on your own computer called the hosts file.
After that, it doesn’t matter how carefully you type. You land on a convincing fake, and the address bar may show exactly what you expected. Which is nasty, because “check the address” is the main thing everyone gets told. The upside, if there is one, is that pulling this off takes real access to systems, not just a list of email addresses, so it’s a lot less common than phishing.
This library is about social engineering, meaning attacks where a person gets fooled. With pharming it’s the machine that gets fooled, so it falls outside the inclusion rules in the methodology. Stretching some other case to make it fit would be worse than just saying so.
What does come close is SEO poisoning, filed under ClickFix and SEO poisoning (6 cases). Someone searches for something ordinary and a rigged result sends them somewhere bad. GootLoader is a good example. In 2021 its operators had hijacked pages sitting at the top of Google for searches about legal agreements. Staff at law firms grabbed what looked like a template, got malware, and at some firms it ended in ransomware. Full case: GootLoader and legal services firms.
And in 2026 a fake ChatGPT download site, openew[.]app, picked up visitors through malvertising and search poisoning, then handed Windows and Mac users malware that steals credentials. Full case: fake ChatGPT download site.
Tip: bookmarks and official apps beat search results for anything like banking or work logins. If a site you use daily suddenly throws a certificate warning, don’t click past it. Something’s off, so find out what.
For the people side of the problem, have a look through the phishing cases.
Persuasion versus rerouting. A phishing message needs you to follow its link. Pharming fiddles with DNS or your device so you get sent to the fake even after typing the address correctly.
For any one person it’s harder to spot. But it’s much harder to set up, so it happens far less. Phishing does more damage overall simply because it’s cheap and it’s everywhere.
Often you can’t, at least not right away. Look out for certificate warnings on sites you use all the time, a familiar page that looks a bit off, or a login that fails when you’re sure the password was right. If something seems wrong, change the router password and get the device checked.
It helps quite a bit. A fake site usually can’t show a valid certificate for the real address, so the browser should warn you. That only works if people don’t click straight past the warning, though.
Reviewed by the SEE Team on 22 October 2026; every case linked here has its sources on its own page. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples