Phishing is a type of cyberattack where criminals trick you into giving them sensitive information, like passwords or credit card numbers. Think of it as fishing for your private data, but with a clever disguise as bait.

The term first appeared in the mid-1990s among hackers trying to steal America Online (AOL) accounts. They sent messages posing as AOL employees to get users to reveal their passwords. The 'ph' is a nod to the hacking subculture, similar to how 'phone phreaking' was used to describe exploring the phone network.

At its core, phishing is social engineering. It doesn't rely on breaking through complex security software. Instead, it exploits human psychology to manipulate people into making a mistake, like clicking a malicious link or opening a dangerous attachment.

Phishing attacks come in several forms, each using a different channel to reach its target. While the method varies, the goal remains the same: deception and theft.

These emails often impersonate well-known companies like banks, social media platforms, or online stores. They might claim there's a problem with your account or offer an enticing deal to lure you into clicking a link.

A more targeted and dangerous variant is spear phishing. Instead of casting a wide net, attackers focus on a specific individual or organization. They research their target, gathering details from social media or company websites to make the fake message highly believable. For example, a spear phishing email might reference a recent project you worked on or mention a colleague by name.

When spear phishing targets high-profile individuals like CEOs or government officials, it's called whaling. These attacks are meticulously crafted and can lead to massive financial or data losses.

Phishing isn't limited to email. Vishing (voice phishing) happens over the phone, where a scammer might pretend to be from your bank or a tech support company. Smishing (SMS phishing) uses text messages to send malicious links, often disguised as delivery notifications or bank alerts.

Phishing works because it triggers basic human emotions. Attackers are masters of psychological manipulation and use several key tactics to bypass our rational judgment.

One of the most common is creating a sense of urgency or fear. Messages that warn of a suspended account, a security breach, or a missed payment make people panic and act quickly without scrutinizing the details. The attacker wants you to react, not think.

Another powerful trigger is authority. By impersonating a boss, a government agency like the IRS, or a trusted company, attackers leverage our natural tendency to comply with figures of authority.

Greed and curiosity are also effective hooks. An email promising a prize, a tax refund, or a shocking video can be too tempting to ignore. These scams prey on our desire for gain or our fear of missing out.

These tactics are often combined. An email might look like it's from your CEO (authority) asking you to urgently (urgency) transfer money for a secret deal (curiosity and reward). This combination of triggers can be highly effective, even against cautious individuals.

Understanding these psychological tricks is the first step toward recognizing them. When you receive an unexpected message that makes you feel rushed, scared, or overly excited, it’s a good signal to pause and investigate before taking any action.