What is phishing?

• A. A standard IT support call
• B. An online game
• C. A legitimate security training program
• D. A fraudulent attempt to obtain sensitive information by posing as a trustworthy entity

Answer: (D)

Phishing is a deceptive tactic in which someone pretends to be a trustworthy entity to trick you into revealing sensitive information such as passwords, account numbers, or security codes. Attackers often reach you by email, text, or phone, claiming to be your bank, a service you use, or a colleague, and they create a sense of urgency or fear to lure you into acting without thinking. You might be asked to click a link to a fake login page, enter credentials, or call a number and disclose information. Recognizing phishing involves noticing suspicious senders, generic greetings, urgent or frightening language, unusual requests, and links that don’t match the legitimate site. A good defense is to verify requests through independent channels, hover over links to preview the real URL, avoid sharing personal data in response to unsolicited messages, enable two-factor authentication, and report the message. The other options describe normal IT support, a game, or legitimate training, none of which involve impersonation to steal information, so they don’t capture what phishing is.