Phishing is a social-engineering attack that uses a fake message to trick someone into revealing sensitive information.
A phishing message may imitate a bank, employer, delivery company, technology provider, or friend. It commonly asks the recipient to click a link, open an attachment, transfer money, or provide credentials. Attackers often use urgency, fear, or a convincing visual design to make the request seem legitimate.
Phishing can arrive by email, text message, voice call, or social-media message. Targeted attacks against particular people or organizations are often called spear phishing, while highly personalized attacks against senior executives may be called whaling.
Phishing is broader than merely using a fake website. The defining feature is deception aimed at manipulating a person, and the stolen information may include passwords, payment details, or authentication codes.