Phishing

Phishing is social engineering that impersonates a trusted person, service or process to persuade someone to disclose information, approve access, send money or run malicious content. It may arrive through email, messaging, voice, QR codes or convincing websites and may use real account context. Filtering and awareness reduce exposure but neither catches every attempt. MFA helps, although some methods can still be bypassed through session theft or approval abuse. Defence should combine protected identity, verified payment or change procedures, reporting channels, browser and email controls and rapid response. Tests and exercises must be authorised and avoid shaming users. Useful measures include reporting speed, containment and repeated process weaknesses, not only how many recipients clicked a simulated message.