What is Phishing?

The most successful cyberattack in history breaks no software at all — it persuades you to open the door yourself. Phishing is the bait message impersonating a trusted sender — your bank, the tax authority, a courier, a colleague, Microsoft — nudging you toward one action: clicking through to a cloned login page (the password typed there goes straight to the attacker), opening an infected attachment, or paying a subtly altered invoice. The forms keep evolving as defenses improve: the clumsy email full of typos has been joined by spear phishing (targeted, well-researched, flawlessly written with AI), smishing (text messages about a waiting parcel), vishing (voice calls, including cloned voices) and QR-code lures that slip past email filters. For companies, the prized targets are employee mailboxes — a compromised account becomes a launchpad, since the attacker reads real correspondence, learns the relationships, then strikes clients and suppliers in your name inside genuine conversations — and payment workflows. Mature defense has three floors, ranked by return on effort: two-factor authentication on every account that matters (hardware keys and passkeys are practically phishing-proof); trained reflexes — not bravado, but habits: sender address checked, links opened from bookmarks rather than messages, money and data requests confirmed on a second channel, periodic simulations keeping the guard up; and technical hygiene — modern mail filtering plus SPF, DKIM and DMARC on your own domain, so you are not the one easily imitated. The sentence that summarizes the field: phishing succeeds not where people are stupid but where they are rushed — real defense makes verification easier than haste.