Phishing is a social engineering attack that impersonates a trusted party to steal secrets or to push a hurried payment.
The lure is usually a message or a page that creates urgency, while the real goal is a password, a code, or money.
How it works
Classic phishing arrives by email and copies the look of a bank, an employer, a carrier, or a vendor.
The message asks the reader to sign in, open a file, or move money before there is time to think.
The harm is account takeover, fraudulent payment, or a foothold for a later intrusion.
It depends on persuasion, so technical filters help, but people still need a practiced way to pause.
Concrete examples
- An employee receives a mail that copies payroll and asks for a new bank account for a supposed executive.
- A customer gets a parcel notice that leads to a fake shop login and captures the password.
- A finance clerk is pushed to pay a vendor invoice that repeats a real invoice number with a new account.
Protective measures
- Give people a single internal path to report suspicious mail, and acknowledge reports so the habit sticks.
- Block lookalike domains and unexpected attachment types at the mail gateway before they reach inboxes.
- Require a second channel, such as a known phone number, before changing a payment account.
- Run authorized practice messages so staff can rehearse reporting without shame and without real loss.
Related articles
What is smishing? explains the same style of lure when it arrives as a text message instead of mail.
What is phishing awareness training? explains lessons that teach people to recognize and report phishing lures.
What is a phishing simulation? explains an authorized exercise that sends harmless lookalike messages and measures response.