Phishing

Phishing is a social engineering attack in which a criminal impersonates a trusted institution, company or person to trick the victim into revealing sensitive information — passwords, payment card numbers or login credentials — or into installing malware. The name plays on "fishing", because the attacker "casts bait" and waits for the victim to bite.

How phishing works

The most common channel is a fake email or text message that looks like a communication from a bank, a service provider or a government office. The message typically creates pressure — warning of a blocked account, an overdue payment or suspicious activity — and directs the victim to a spoofed login page that closely mimics the original. Any data entered there goes straight to the criminal.

The attacks come in many forms: mass phishing blasted to thousands of recipients, precisely targeted spear phishing aimed at a specific person, smishing (via SMS) and vishing (via phone). The common thread is exploiting the victim's trust and emotions rather than a technical flaw.

Practical application

Defending against phishing combines user vigilance with technical safeguards. On the email side, sender-authentication mechanisms are key — SPF, DKIM and DMARC — which make impersonating real domains harder and let spoofed messages be filtered out. Properly configured email as part of domain hosting significantly reduces the effectiveness of impersonating a company's address.

At the account level, the best barrier is two-factor authentication: even if a password is stolen, an attacker can't log in without the second factor. Spam filters, employee training and verifying addresses before clicking a link provide complementary protection.