Phishing is the most common form of social engineering \u2013 instead of exploiting a technical weakness, attackers manipulate people. A forged message creates urgency or trust and leads the victim to hand over credentials or open a malicious attachment.<\/p>\n
The term comes from \u201cfishing\u201d: attackers cast a lure and wait to see who bites. Classic phishing is sprayed at scale, while modern campaigns are increasingly targeted and AI-assisted \u2013 linguistically flawless and tailored to the recipient. For companies, phishing is the most common way in for data breaches and ransomware; regulatory frameworks such as DORA<\/strong> and NIS2<\/strong> therefore explicitly require awareness measures and reporting paths. The decisive point: phishing cannot be solved by technology alone \u2013 the last line of defence is an informed person.<\/p>\n","protected":false},"featured_media":0,"template":"","glossary_intl_set":[],"glossary_intl_cluster":[392],"glossary_intl_theme":[],"class_list":["post-29149","glossary_intl","type-glossary_intl","status-publish","hentry","glossary_intl_cluster-cybersecurity"],"acf":{"card_description":"A cyberattack in which attackers obtain confidential data through forged messages.","nav_theme":"","nav_subtheme":"","dataset_version":"","term_inline":"","term_plural":false,"heading_overrides":null,"synonyms":[{"value":"Credential harvesting"},{"value":"Email identity theft"}],"lead_definition":"Phishing is a form of cyberattack in which attackers use forged emails, websites or messages to obtain confidential data such as passwords or credit card details. Victims are deceived because the attacker poses as a trusted sender.","at_a_glance":[{"bullet":"Phishing targets people<\/b>, not technology (social engineering)."},{"bullet":"Most common channels: email, SMS (smishing), phone (vishing), QR code (quishing)."},{"bullet":"The most effective defence: multi-factor authentication<\/b> plus awareness plus technical filters."}],"intro_answer":"","steps_answer":"","steps":null,"examples":[{"example":" Fake bank email:<\/b> \u201cYour account has been locked \u2013 please confirm your details.\u201d The link leads to a rebuilt login page.<\/p>\n"},{"example":" CEO fraud:<\/b> An email in the name of the management asks accounting for an urgent transfer.<\/p>\n"},{"example":" Loss scenario:<\/b> Stolen credentials open the way to a ransomware incident \u2013 a reportable loss under NIS2.<\/p>\n"}],"misconception":[{"myth":"\u201cYou can always spot phishing by the bad spelling.\u201d","reality":"Modern, AI-assisted phishing mail is linguistically flawless and often personalised. Checking the sender and the link target is far more reliable."}],"faq":[{"q":"What is the difference between phishing and spear phishing?","a":"The difference is effort: bulk phishing plays the numbers, spear phishing invests research in a single target \u2013 and is much harder to spot. Rule of thumb: the more personal a message feels, the more carefully it deserves checking. CISA<\/a> collects examples of both."},{"q":"Is phishing a criminal offence?","a":"Yes. In Germany phishing meets the elements of offences such as computer fraud (\u00a7 263a StGB<\/a>) and unlawful access to data (\u00a7 202a StGB<\/a>)."},{"q":"Why do trained employees still fall for phishing?","a":"Because phishing attacks behaviour, not knowledge: time pressure, authority and routine switch off critical checking. That is why simulations and simple reporting paths work better than theory alone \u2013 the BSI<\/a> argues the same."}],"compare_answer":"","compare":null,"variants":[{"title":"Smishing","inline_description":"Phishing over SMS or messengers","description":"Smishing is a form of phishing over SMS or messaging apps \u2013 usually a link to a forged page.","source":"BSI: recognising smishing","key":"SMS"},{"title":"Vishing","inline_description":"Phishing over a phone call (voice)","description":"Vishing is phishing over a phone call, in which attackers talk the victim into disclosing confidential data.","source":"ENISA Threat Landscape","key":"Phone call"},{"title":"Quishing","inline_description":"Phishing through manipulated QR codes","description":"Quishing is phishing through manipulated QR codes that lead to forged websites.","source":"BSI: QR code fraud","key":"QR code"},{"title":"Spear phishing","inline_description":"A targeted attack on one person or role","description":"Spear phishing is a targeted phishing attack on a specific person or role that draws on personal information.","source":"CISA: Spear Phishing","key":"Personalised email"},{"title":"Whaling","inline_description":"Spear phishing aimed at senior executives","description":"Whaling is a form of spear phishing that specifically targets senior executives.","source":"ENISA","key":"Personalised email"},{"title":"Clone phishing","inline_description":"A copy of a genuine email with a malicious link","description":"Clone phishing copies a legitimate email and replaces links or attachments with malicious versions.","source":"CISA","key":"Bulk email"}],"signals_answer":"","signals":null,"protect_answer":"","prevent":null,"incident":null,"related_terms":null,"pillar_link":null,"sources":[{"publisher":"","name":"BSI: Spam, Phishing & Co.","url":"https:\/\/www.bsi.bund.de\/DE\/Themen\/Verbraucherinnen-und-Verbraucher\/Cyber-Sicherheitslage\/Methoden-der-Cyber-Kriminalitaet\/Spam-Phishing-Co\/spam-phishing-co_node.html","doc_type":"","group":"used"},{"publisher":"","name":"ENISA Threat Landscape","url":"https:\/\/www.enisa.europa.eu\/publications\/enisa-threat-landscape-2024","doc_type":"","group":"used"},{"publisher":"","name":"CISA: Recognize and Report Phishing","url":"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing","doc_type":"","group":"used"}],"reviewer":{"name":"Jakub Novak","qualification":"IT security","date":"2026-06-01"},"disclaimer":""},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t