What is phishing?
Phishing is a social engineering attack that tricks victims into handing over credentials or sensitive data through fake messages.
TL;DR
- Phishing is a deception technique where attackers impersonate a trusted party — via email, SMS, or fake websites — to lure victims into revealing passwords, card numbers, or personal data.
- It remains one of the most common entry points for breaches and ransomware.
- Defences combine user awareness, technical controls, and monitoring of exposed credentials.
Short definition
Phishing is a deception technique where attackers impersonate a trusted party — via email, SMS, or fake websites — to lure victims into revealing passwords, card numbers, or personal data.
Why is phishing still the main entry point?
Phishing remains the main entry point for many security incidents — from stolen employee credentials to fraudulent fund transfers. Techniques keep evolving, from mass emails to targeted spear phishing that leverages victim-specific information.
An organization's email security maturity — SPF, DKIM, and DMARC — largely determines how easily attackers can spoof its domain for phishing. It is also one of the factors measured in security ratings.
What are some practical examples?
- An email posing as the IT department asking employees to change passwords via a fake link.
- A replica bank website mimicking the real one to steal customer data.
- A WhatsApp message impersonating an executive urgently requesting a fund transfer.
Learn more
Frequently asked questions
Related terms
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating