Phishing
A scam by email, message, call or fake website that impersonates someone trusted to steal credentials or money, or to install malware.
Pronunciation
What it is
Phishing is a social engineering attack: the attacker poses as a bank, a vendor, a coworker or a well-known service to get the victim to do something that benefits the attacker. For example, typing a password into a fake site, opening an attachment with malware or making a transfer.
The name comes from fishing: cast a hook and wait for someone to bite.
Variants
| Variant | Channel | What it looks like |
|---|---|---|
| Mass phishing | Thousands of identical messages: “your account will be suspended” | |
| Spear phishing | Targets one person, with real details about their role or company | |
| BEC (business email compromise) | Impersonates an executive or a vendor to request a payment or change a bank account | |
| Smishing | SMS or WhatsApp | “Your package is on hold, pay here” |
| Vishing | Phone call | Fake tech support or fake bank asking for codes |
| Quishing | QR code | A QR code in an email or on a poster that leads to a fake site |
Why it matters
The human element shows up in more than two thirds of the breaches analyzed in Verizon’s 2024 DBIR, and phishing is one of its most common forms. A credential-stealing email is also often the first step of bigger attacks such as ransomware.
Warning signs
- Urgency or fear: “blocked in 24 hours”, “overdue payment”, “lawsuit”.
- A sender or domain that almost matches:
nextsoft-corp.coinstead ofnextsoftcorp.com. - Unusual requests: changing a vendor’s bank account, buying gift cards, sharing a code.
- Links that don’t go where they say: hover before you click.
- Unexpected attachments, especially archives or files with macros.
Demo example: an email “from the vendor”, with the right logo, asks to update their bank account for the next payment. The rule that stops it: every change to payment details is confirmed through a different channel, by calling the number already on file.
How to reduce the risk
- Phishing-resistant MFA (FIDO2 keys or passkeys): even with the password, the attacker cannot sign in.
- Email domain authentication (SPF, DKIM and DMARC): makes it harder for others to send email pretending to be your domain.
- Email and web filtering, with attachment sandboxing.
- Verification processes for payments and changes to sensitive data.
- Training with simulations and a simple, blame-free way to report suspicious emails.
Related terms
- MFA - The most effective defense against credential theft
- Ransomware - An attack that often starts with a phishing email
- Zero Trust - Limits what an attacker can do with a stolen account
- Prompt Injection - The same kind of deception, aimed at an AI system
Official resources: