What is Phishing?

Social engineering is influence used as an attack: get a person to do something unsafe that technology would have blocked if the person had refused. Phishing is that influence packaged as communication you already use — mail, SMS, chat, voice, a QR on a poster. The attacker impersonates a trusted person or brand so you open a link, type a password on a fake page, install something, or move money. The word comes from fishing: many hooks, one bite. You do not need to be "tech dumb" to get caught. You need to be hurried, scared, helpful, or proud of being responsive — exactly the states the copy is written to produce.

The message is the delivery channel, not the whole crime. After you bite, three different thefts are common, and defenders must not mash them into one slogan. Credential harvest copies what you type (password, session, one-time code) on a lookalike site. Malware follows a file or a drive-by that runs code on your device. Wire-fraud / business email compromise skips your password entirely and talks you into changing a payee or sending a transfer. Same lure family. Different damage. Different first aid. Topic 4 already taught you that a unique password and a second factor contain credential theft; they do not undo a wire you already sent, and they do not magically remove malware. Name the theft, then pick the control.

Trust is borrowed recognition. Humans authenticate brands the way we authenticate faces: logo, color, familiar subject line, a name we have seen in the inbox. Cryptography authenticates with certificates and DNS. Phishing wins when you use the human method on a channel that does not prove identity. A display name that says "Payroll" is not a signature. A padlock on a lookalike host is TLS to the wrong name. Filters can block known-bad domains; they cannot feel that you "know" this sender. The attacker does not need your admiration. They need a half-second of unearned familiarity so you skip the From domain.

Urgency collapses the verification window. "Account locked in 15 minutes," "package returned today," "CEO needs this before close" are not personality. They are a timer on working memory. Careful checking — expand the sender, long-press the URL, open the official app — takes tens of seconds. Panic takes one tap. Real banks and employers almost never need you to authenticate through a surprise link on a countdown. The rare true emergency (a card you already know was stolen) is handled in the app or the number printed on the card, not in a message you did not solicit. If the only way to "save" the situation is to click now, the situation is the attack.

Authority is rank used as a shortcut past challenge. People are trained not to interrogate Legal, IT, a bank, or a founder. Phishing copies that hierarchy: "Your manager asked me to handle this," "Security has flagged your account," "This is the CFO." Challenging authority feels rude; phishing needs that politeness. The defensive move is not rudeness for its own sake. It is a second channel you already trust: call the person on a number you already have, walk to their desk, open the app you installed last year. Authority in a cold message is a claim. Authority on a callback you initiated is a check. Topic 4's MFA is the same idea in silicon: a second factor the message cannot complete.

Credential harvest is the classic fake login. You meant to sign in to mail or a shop. The page looks right. You type the password (and maybe an MFA code). The attacker now has the know, and if you typed a live code, they may have a short window on the have. This is why Topic 4 insisted on unique passwords: a harvested forum password must not open mail. It is why MFA on email and the password manager matters: a stolen password should not be the whole door. It is also why you never type a code because a stranger "needs it to cancel a transaction." The code is the second factor. Giving it away is finishing their login.

Malware phishing uses the message to run code: an unexpected attachment, a disk image, a double extension, a macro document you did not ask for. The goal is a foothold on the device — steal more sessions, encrypt files, spy. Unique passwords do not stop a running trojan, though they still limit reuse if the malware later dumps a browser vault. The defensive habit is not "open it in a sandbox to see." It is refuse unexpected executables, verify the sender out of band, and keep the OS patched (Topic 1). This course will not give you payloads, unpack kits, or tell you to detonate samples. If you already opened a bad file, that is incident response in a later module — not a lab for curiosity.

Wire-fraud and invoice redirection are phishing without a password field. The email looks like a vendor or a boss and asks you to pay a new account, buy gift cards, or "update banking details." MFA does not save a transfer you authorized. The mechanism is still trust plus urgency plus authority. The control is a callback on a number from a contract or an HR directory, never from the email signature of the suspicious thread. Do not practice this against a real company. Do not "test" a bank. Classify the ask: is this a secret, a file, or a payment? Payments get a second channel every time.

Mail gateways and phone spam classifiers are good at yesterday's known-bad: listed domains, reused kits, obvious spam vocabulary. They are weaker at first-seen lookalikes, freshly registered names, mail that was forwarded from a compromised coworker, and copy that is short and polite. The filter did not fail because you are foolish. It failed because the malicious bit was your willingness to treat a logo as identity. That is not a reason to turn filters off. It is a reason they are necessary but not sufficient. Your job is the human check the model cannot feel: did I expect this, does the domain match, will I use a path I already trust instead of this message's link?

Attackers also ride compromised real accounts. A message from a friend's real address can still be phishing if their mailbox was stuffed last month. That is another reason Topic 4's uniqueness and MFA matter for everyone you know: their breach becomes your lure. You still do not click a surprise "look at this invoice" from a friend without a second check. The From domain being "correct" is not the same as the human being present.

On paper or in a private notes file, pick one message you actually received this month that asked you to act. Do not click its links. Write: channel (email/SMS/chat), which mechanism it leaned on (trust, urgency, authority — in a sentence, not a label), and which theft it would have enabled if you had complied. Then write one Topic 4 control that would shrink damage: unique password on that account, MFA on mail, or both. If you have no such message, use the fictional sample in the code block — still do not visit the URL.

# FICTIONAL sample for classification ONLY.
# Do NOT open, ping, or type this host in a browser.

# From: "Example Bank Security" <[email protected]>
# Subject: URGENT: Verify within 15 minutes or your account closes
# Body: "Dear Customer, click https://paypa1-security.example/login"

# Write on paper (no live secrets, no real bank names required):
# channel: email
# trust_borrowed: (logo / display name / "bank" wording)
# urgency: (timer / threat)
# authority: (security / bank)
# likely_theft: credentials / malware / wire   (pick one primary)
# topic4_control: unique password? MFA on mail? both?
# safe_action: ignore link; open official app or number on MY card

# NEVER: visit paypa1-security.example or any lookalike
# NEVER: send a phish, build a kit, or "test" a real bank
# NEVER: paste passwords or MFA codes into a message or this app

You now treat phishing as a message that steals trust, not as a cartoon hacker. Trust, urgency, and authority are why a busy human skips the domain. Harvest, malware, and wire-fraud are why the next click is not one problem. Filters help; they do not feel logos. Topic 4 still matters after a phish: uniqueness and MFA contain credential theft. Next — Email Phishing Red Flags — you inspect From domains, lookalikes, and links without visiting them.