What Is Phishing? How AI Is Making It Worse, and How to Detect It in Your App with APIs
01Introduction
Phishing is a scam where attackers pose as someone you trust, usually through an email, text or chat message, to get you to click a link, share a password or send money. A data breach is what often follows: someone gains access to data they shouldn't have, and a phishing click is one of the most common ways in.
Both are getting harder to spot. AI now writes convincing messages in any language, clones voices and builds fake websites in minutes. This guide explains what phishing and data breaches are, what AI has changed, and five checks you can build into your own app with APIs to catch phishing links and fake accounts before they reach your users.
02What is phishing?
The US Federal Trade Commission describes phishing this way: "Scammers use email or text messages to trick you into giving them your personal and financial information."
Phishing messages tend to follow the same script. They:
- Warn about suspicious activity or a problem with your account
- Ask you to confirm personal or payment details
- Include an invoice you don't recognize
- Push you to click a link to pay, log in or "fix" something
The link is where the damage happens. It leads to a fake login page, a payment form or a download that installs malware.
03What is a data breach?
A data breach is any incident where information is accessed or taken without permission: customer records, passwords, payment details or internal files. Phishing is one of the main entry points, because one stolen login can open the door to everything that account can see.
Breaches are expensive. IBM's 2025 Cost of a Data Breach Report puts the global average cost at USD 4.44 million per breach.
They also increasingly start outside your own walls. Verizon's 2026 Data Breach Investigations Report, published in May 2026, found that third-party involvement in breaches rose 60%, and that breaches involving external vendors now make up 48% of all incidents. We come back to that number below, because it matters for how you manage the services your app depends on.
04How AI is changing phishing
AI has made phishing cheaper to produce and harder to recognize. The old warning signs, like broken grammar or a generic greeting, are fading fast.
The numbers are starting to show it:
- AI scams now have their own category at the FBI. The FBI's 2025 Internet Crime Report, released in April 2026, tracked AI scams separately for the first time: 22,364 complaints and nearly USD 893 million in losses. Tactics included fake social media accounts, voice cloning, fake ID documents and fabricated videos.
- Attacks are moving to phones. Verizon found that mobile-based social engineering succeeds 40% more often than traditional email phishing.
- Attackers move faster. The same report says AI shrinks the window for defense "from months to mere hours."
- Employees use AI tools nobody approved. Verizon measured "shadow AI" use growing from 15% to 45% of employees in a single year. IBM found that high levels of shadow AI added USD 670,000 to the average breach cost, and that 97% of organizations with an AI-related security incident lacked proper AI access controls.
There is one more change worth planning for. AI agents now read emails, open links and sign up for services on behalf of people. An agent that follows a malicious link or trusts a fake sender is a new way in, and it needs the same checks a careful person would make.
05Five checks that catch phishing in your app
If your product handles links, messages or signups, you can catch much of this automatically. The five checks below each target one phishing signal and each map to an API in the ApyHub catalog.
To make it concrete, picture Relay, a team chat app. Users share links in channels, invite people by email and connect their inboxes. Here is how Relay protects them.
1. Expand short links to see the real destination
Phishing messages hide their destination behind short links, so the user can't see where they lead.
Relay sends every shared short link to the Resolve Short URL API. It follows each redirect (up to 30 hops) and returns the final address plus the full redirect chain. A "bit.ly" link that lands on a lookalike login page is now visible for what it is.
2. Check links against known threats and show a safe preview
Next, Relay passes the final address to the Generate Link Preview API. With secure mode on (the default), it checks the link against a database of malicious URLs before fetching anything.
A flagged link comes back like this:
json
{
"data": {
"url": "http://example-malicious-site.com",
"threat": "malware",
"reported_malicious": true
}
}Relay blocks flagged links and shows a warning. For clean links, the same call returns the page's real title, description, image and site name, so Relay shows a preview card and users can see where a link goes before they click.
3. Flag brand-new domains
Phishing sites are usually new. Attackers register a lookalike domain, use it for a campaign and move on.
Relay checks each linked domain with the Domain Age API, which returns the domain's creation date and age in days. Links to domains registered in the last 30 days get a caution label. For deeper checks, the Domain WHOIS Lookup API returns the full registration record.
4. Check that a sender's email address is real
Phishing often comes from addresses on domains that can't receive mail, or that were set up for one campaign.
When someone invites a new member or connects an inbox, Relay runs the address through the Email Deliverability Score API. It returns a score from 0 to 3 based on three signals: valid syntax, working mail servers (MX records) and whether the domain is disposable. Low scores go to review.
5. Block throwaway accounts and score risky signups
Fake accounts are how attackers get inside a product to phish its users from within.
At signup, Relay checks addresses with the Temporary and Disposable Emails API and blocks throwaway inboxes. For higher-risk actions, like inviting an entire company, it calls the Identity & Fraud Verification API. It checks email, IP, phone and other signals in one request and returns a risk score with a recommendation to accept, review or reject.
Together, these checks cover the path a phishing attack usually takes: the message, the link, the destination and the account behind it.
To try any of them before writing code, open the request in Voiden, the open-source API client, add your API key and run it.
06The bigger risk: your own external services
Verizon's finding that 48% of breaches involve a third party points at something beyond phishing. Every external service your product uses is part of your security surface.
A typical product today calls a long list of outside services: email validation from one vendor, fraud scoring from another, file conversion, maps, AI models. Each one comes with:
- Its own account, API key and billing
- Its own terms, data processing agreement and security review
- Its own place where keys get stored, shared and forgotten
This spread creates the same problem at company scale that phishing creates for individuals. Nobody has the full picture. Keys live in old scripts and former employees' laptops. A vendor gets added without a security review because the team needed it by Friday. And when AI agents start calling these services directly, each agent needs credentials too.
Centralizing your external services in one place gives you back that picture:
- One vetting process. Services are reviewed once, against the same standard, before anyone uses them.
- One key to manage. One credential to rotate or revoke, instead of dozens spread across vendors.
- One view of usage. You can see which services are called, by which team or agent, and how often.
- One compliance story. Certification evidence (GDPR, SOC 2, ISO 27001) sits in one place for your own audits.
- Controlled access for AI agents. Agents get a defined, scoped set of tools, instead of whatever credentials happen to be in reach.
Centralizing has a trade-off. The layer you centralize on becomes a critical dependency, so evaluate its own security, certifications and uptime with the same care. It also doesn't replace your own security program: training, access controls and incident response still matter.
07Where ApyHub fits
ApyHub is built as that central layer for APIs. Every API in the catalog, including the five used above, is verified before listing and carries machine-readable certification for GDPR, SOC 2 and ISO 27001. One subscription and one API key cover the whole catalog.
For AI agents, every endpoint is available through ApyHub MCP. An agent can discover, evaluate and call these security checks directly, without a hand-written wrapper or tool definition, and teams can scope which APIs each agent is allowed to see. That means an agent reading a customer's email can check a link's safety before acting on it.
Explore the security and validation APIs →
08Conclusion
Phishing tricks people into clicking, sharing or paying, and data breaches are often the result. AI has made both faster and more convincing, and the old advice to look for spelling mistakes no longer holds up.
Products can do more than warn users. Expanding short links, checking links against known threats, flagging new domains, verifying senders and blocking fake accounts catch much of the attack before a person has to judge it. And because nearly half of breaches now involve a third party, the way you manage your own external services is part of the same defense. Fewer vendors, fewer keys and one place to review and control them leave attackers fewer ways in.
09FAQ
What is phishing? Phishing is a scam where attackers pretend to be a trusted company or person, usually by email, text or chat, to get you to click a link, share login details or send money.
What is a data breach? A data breach is any incident where data is accessed or taken without permission. Phishing is a common cause, because one stolen login can expose everything that account can access.
How is AI making phishing worse? AI writes fluent, personalized messages in any language, clones voices and builds fake websites quickly. The FBI recorded nearly USD 893 million in losses from AI scams in 2025, the first year it tracked them separately.
How can I detect phishing links in my app? Expand short links with the Resolve Short URL API, check the destination with the Generate Link Preview API in secure mode, and flag domains registered in the last few weeks with the Domain Age API.
How do I stop fake accounts at signup? Block disposable addresses with the Temporary and Disposable Emails API, check deliverability with the Email Deliverability Score API, and score risky signups with the Identity & Fraud Verification API.
How can I test these APIs before integrating them? You can run each one from its API page on ApyHub, send a request from your terminal, or open it in Voiden, the open-source API client. All three work on the free plan.
Can AI agents use these checks? Yes. Every endpoint is available through ApyHub MCP, so an agent can check a link or an email address before it acts on it.
Isn't centralizing external services a single point of failure? It concentrates risk in one provider, so choose one with strong certifications and a clear security posture. In exchange, you get one place to vet, monitor and revoke access, instead of dozens of vendors with separate keys and reviews.
10Sources
- Federal Trade Commission, How to Recognize and Avoid Phishing Scams
- FBI, 2025 Internet Crime Report press release, April 2026
- Verizon, 2026 Data Breach Investigations Report news release, May 2026
- IBM, 2025 Cost of a Data Breach Report, July 2025
11About ApyHub
ApyHub is a curated API catalog and trusted operational layer for developers and AI agents. The catalog offers over 1,500 endpoints and capabilities, and it keeps growing. Every API is verified before listing and carries machine-readable certification for GDPR, SOC 2 and ISO 27001.
One subscription covers the whole catalog. Usage is measured in atoms, a per-call unit that reflects the compute work each request does. Every endpoint is MCP-ready by default, so AI agents can call it through ApyHub MCP without custom wrappers.
ApyHub is headquartered in Amsterdam, with offices in the Netherlands, Greece and India, and serves 65,000+ monthly developer workspaces. The free plan needs no credit card. API providers can publish their APIs to the catalog through the provider program.