phishing, act of sending e-mail that purports to be from a reputable source, such as the recipient’s bank or credit card provider, and that seeks to acquire personal or financial information. The name derives from the idea of “fishing” for information.
In phishing, typically a fraudulent e-mail message is used to direct a potential victim to a website that mimics the appearance of a familiar bank or e-commerce site. The person is then asked to “update” or “confirm” their accounts, thereby unwittingly disclosing confidential information such as their Social Security number or a credit card number. In addition to or instead of directly defrauding a victim, this information may be used by criminals to perpetrate identity theft, which may not be discovered for many years.
In a type of phishing known as “spear phishing,” e-mails are sent to selected employees within an organization, such as a company or government agency, that is the actual target. The e-mails appear to come from trusted or known sources. By clicking on links within the e-mail after being persuaded to do so by the e-mail’s seeming legitimacy, employees let hostile programs enter the organization’s computers.
The American search engine company Google said in 2019 that its web-mail program Gmail blocked 100 million phishing e-mails every day. According to the global Anti-Phishing Working Group, as of 2021, hundreds of thousands of phishing websites appeared every month.