WHAT IS PHISHING?

Phishing is a type of online fraud where attackers impersonate trusted people, services, or organizations to trick victims into revealing sensitive information (passwords, payment details, personal data) or performing actions that compromise security. The core is deception: the message, website, or call is crafted to look legitimate so the target will act without verifying.

Phishing is primarily a social-engineering attack — it targets human trust, not just software. While phishing often uses technical components (malicious links, fake domains, attachments), its success depends on convincing a person to take the bait.

WHY IS IT CALLED AS PHISHING?

The term “phishing” borrows the metaphor of fishing: attackers cast bait (fake messages) and wait for victims to bite. Early use of the term appeared in the 1990s in relation to attacks on online services (like America Online), where attackers “phished” for account credentials using deceptive messages. The spelling with a ph follows hacker-culture conventions (similar to “phreaking”), and it stuck.

In short: just as fishermen use baited hooks to catch fish, cybercriminals use crafted lures (emails, pages, texts) to catch people’s sensitive information — hence “phishing.”