- A form of online fraud where cybercriminals attempt to trick people into revealing sensitive personal information.
- They do this by impersonating legitimate institutions (like banks, companies, social media sites, government agencies) through deceptive emails, text messages (smishing), phone calls (vishing), or fake websites.
- The goal is to steal login credentials (usernames, passwords), credit card numbers, bank account details, social security numbers, etc.
Explanation
Origin
- The term emerged in the mid-1990s within the hacker community.
- It's a deliberate respelling of fishing, using ph which was common in early hacker/phreaker culture (e.g., phreaking exploring phone systems).
- The metaphor is apt: criminals use deceptive bait (the fraudulent message or website) to fish for victims' valuable information.
Synonyms & Related Expressions
Alternatives
Slang/Informal:
- Scam email/text/call
- Trying to jack/nick your login/details
- Fake login page
More Formal/Technical:
- Social engineering attack
- Credential harvesting attempt
- Fraudulent solicitation of sensitive information
- Email spoofing for fraudulent purposes
Situational Appropriateness
- Appropriate in informal, semi-formal, and formal contexts.
- Essential terminology when discussing cybersecurity, online safety, digital literacy, and fraud prevention.
Misunderstanding Warnings
- Note the distinct ph spelling.
- Ensure understanding that it's specifically about *deception to steal sensitive information*, differentiating it from other types of online scams (e.g., advance-fee fraud, fake merchandise).
Examples
- I received a phishing email claiming to be from my bank, asking me to verify my password.
- Never click on links or download attachments from suspicious emails; they could be phishing attempts.
- That text message warning about a package delivery issue might be smishing, a type of phishing.
Dialogue
Colleague 1: Hey, did you get that email from HR about updating payroll information?
Colleague 2: Hmm, no, I didn't. Be careful, though – there was a warning last week about phishing emails pretending to be from HR. Does it ask you to log in or provide personal details via a link?
Colleague 1: Yeah, it does... and the sender's address looks a bit off now that I check.
Colleague 2: Definitely sounds like phishing. Don't click it! Forward it to the IT security team.
Social Media Examples
- Tweet (from a security expert): PSA: New phishing campaign targets [Platform] users. Be wary of DMs asking for login verification. #cybersecurity #phishingalert
- Facebook Post (from a community group): Warning! Received a fake energy bill email today – classic phishing scam. Check sender details carefully! #scamalert #phishing
- Company Blog Post: How to Recognize and Avoid Phishing Attacks.
Response Patterns
- Caution/Acknowledgement: Thanks for the heads-up. / Good to know. / I'll be careful.
- Shared experiences: Yeah, I get those all the time.
- Advice: You should report it. / Make sure you didn't click anything.
- Questions about the scam: What did it look like? / Who were they pretending to be?
Common Follow-up Questions/Actions
- Reporting the phishing attempt (to the impersonated company, email/service provider, relevant authorities).
- Warning others about the specific scam.
- Discussing red flags to look for (e.g., generic greetings, urgent tone, spelling errors, suspicious links/sender addresses).
- Changing passwords immediately if credentials might have been compromised.
- Running security scans on devices.
Conversation Starter
- Yes. Can initiate conversations about online safety and security. Have you ever received a convincing phishing email? / What are the latest phishing scams going around?
Intonation
- Emphasis on PHISHING: PHISHing.
- Often said with a cautionary, warning, or informative tone.
Generation Differences
- The term is widely understood by most internet users. Awareness of specific tactics and vulnerability levels might vary by age and digital literacy, making cross-generational discussion important.
Regional Variations
- Universal term in cybersecurity and internet contexts globally.