Phishing
Phishing is a scam that poses as your bank, a social network or a service you use, to get you to hand over your password, a code, or your banking details.
- What it is
- A scam that imitates a real organization
- Since
- 1996 (the term)
- Verdict
- Yes
What it is
According to INCIBE (Spain's national cybersecurity institute), phishing involves sending emails, texts or messages that imitate a well-known entity (your bank, a government office, a service you use) to get you to bite: you're asked to click a link and enter your password, or to provide a verification code, with the excuse of an urgent problem. If you do, the attacker keeps whatever you typed.
The name comes from "fishing," because the attacker casts the same bait at a lot of people at once, with "ph" instead of "f" as a nod to the old slang of "phreaking" (manipulating phone networks).
Since when
The term "phishing" was first documented on January 2, 1996, in a Usenet forum dedicated to America Online (AOL), to describe people stealing passwords from AOL users by posing as technical support. Since then, the technique has spread to email, SMS ("smishing"), calls ("vishing") and messaging apps, and it's one of the threats most documented by INCIBE.
Why it's used
Phishing is cheap and works at scale: the same message is sent to thousands of people at once, and it only takes a small fraction to fall for it to be worth it. It plays on urgency, fear of losing something, or trust in a familiar brand.
The flip side is the angle that matters to us: a password or an SMS code can be phished because you type them into a fake website. A passkey or a security key can't be phished that way, because they're tied to the real website and don't work on a copy, no matter how identical it looks.
Does it affect you?
Yes, everyone: nobody is immune to a well-crafted message at the wrong moment. What changes is how much the attacker can take if it works.
Check this
- Would you be able to spot a fake link even if the page looks a lot like the real one?
- Does any of your critical accounts rely only on a password and an SMS, instead of a passkey or a key?
Official sources: What phishing is (INCIBE)