DataTerminology.comNEW
A social engineering technique where attackers impersonate trusted entities to trick people into revealing sensitive information or installing malware.
DESCRIPTION
Phishing uses deceptive emails, messages, or websites to induce recipients to disclose credentials, financial data, or execute malicious payloads. Variants include spear phishing, smishing (SMS), and vishing (voice). Email authentication (SPF, DKIM, DMARC), phishing-resistant MFA, and user training help reduce risk. Technical controls like sandboxing, web filtering, and anomaly detection complement awareness efforts. Incident response playbooks should include rapid credential revocation and domain takedown procedures.
ALTERNATIVE DEFINITIONS
CISA
Phishing is a form of social engineering where a cyber actor sends a fraudulent message to trick a person into revealing sensitive information or to deploy malicious software.
Highlights both data theft and malware delivery as goals.
U.S. FTC
Phishing is when scammers use emails or text messages to trick you into giving them your personal information.
Plain-language consumer protection framing focused on email and SMS.
RELATED TERMS
Social Engineering Spear Phishing Business Email Compromise Smishing Vishing Credential Harvesting Malware Multi-Factor Authentication Security Awareness Training
COMPETING TERMS
Phishing-resistant MFA DMARC
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Collaboration
TARGET AUDIENCE
Chief Information Security Officer Data Privacy Officer IT Manager Cybersecurity Engineer Security Architect Application Administrator
EXTERNAL SOURCES
- Wikipedia - Phishing
- CISA - Official definition and guidance
- DMARC.org - DMARC overview for email authentication
- NIST - Authenticator guidance and phishing resistance
TOP QUESTIONS
What are common signs of Phishing?
Urgent requests, mismatched domains, unexpected attachments, and login prompts are red flags. Always verify sender identity and URLs.
Category: Example
How effective is MFA against Phishing?
MFA raises the bar, but some factors are phishable. Phishing-resistant factors like FIDO2 offer stronger protection.
Category: Risk
What controls reduce Phishing risk?
Deploy SPF, DKIM, DMARC, web filtering, secure email gateways, and continuous awareness training with realistic simulations.
Category: Best practices
What should I do after clicking a phishing link?
Disconnect from the network if malware is suspected, report to security, rotate credentials, and scan systems promptly.
Category: Operations
Is Business Email Compromise the same as Phishing?
BEC often uses social engineering without malware. It overlaps with phishing but targets wire fraud via impersonation.
Category: Misunderstanding
How do attackers bypass email filters?
They use lookalike domains, image-based text, shortened URLs, or compromised legitimate services to evade detection.
Category: Threats
What is spear phishing?
A highly targeted phishing attack tailored to a specific individual or organization to increase credibility and success rates.
Category: Definition
How do I measure Phishing risk reduction?
Track phishing simulation metrics, report rates, time-to-detection, and credential compromise incidents over time.
Category: Observability
Where should organizations start?
Establish email authentication, deploy phishing-resistant MFA, and run continuous training aligned with clear incident response procedures.
Category: Requirements