Phishing

Phishing is a type of social engineering attack that uses deception to obtain sensitive information such as usernames, passwords, credit card numbers, or access to accounts. It typically involves fraudulent messages that appear to come from legitimate organizations or contacts, prompting the recipient to reveal data or perform actions that compromise security. Phishing can be conducted via email, text messages (smishing), voice calls (vishing), or social media and messaging apps.

Attackers employ techniques including spoofed sender addresses, logos, or domains; urgent or alarming language; requests to click a link or open an attachment; and promises of rewards. The goal is to trick victims into visiting a counterfeit website or entering credentials, or to install malware on a device. Spear phishing targets specific individuals or organizations, while whaling targets executives. Business email compromise is a related form that aims to cause financial losses, often by impersonating a trusted colleague or partner.

Common indicators of phishing include mismatched or unfamiliar domain names, generic greetings, requests for sensitive information, pressure to act quickly, poor grammar, and unexpected attachments or ZIP files. Legitimate organizations typically do not ask for passwords via email or text; users should verify via official channels before responding.

Prevention combines user awareness with technical controls. Email filters, domain authentication methods such as SPF, DKIM, and DMARC, and updated malware protection reduce exposure. Users should enable multi-factor authentication, verify URLs by hovering, and navigate to official sites rather than following embedded links. If in doubt, report suspected scams to the organization and to the IT or security team.