Which of the following best describes phishing?

• A. A method for acquiring sensitive information needed to facilitate a specific scheme by searching through large quantities of available data
• B. A method for acquiring sensitive information in which an attacker hides near the target to gain unauthorized access to a computer system
• C. A method for acquiring sensitive information by falsely claiming through electronic communication to be from an entity with which the target does business
• D. A method for acquiring sensitive information by bypassing a computer system's security through the use of an undocumented operating system and network functions

Answer: (C)

Phishing is a form of social engineering that uses electronic communication to impersonate a legitimate organization or person you do business with, aiming to trick you into revealing sensitive information such as passwords, account numbers, or login details, or into clicking a link to a fraudulent site. The attacker relies on trust and urgency conveyed through emails, texts, or other messages, rather than technical hacking. That focus on pretending to be a trusted entity via electronic communication is what makes this description the best fit. The other ideas describe different techniques—data gathering from large datasets, approaching a target in person to gain access, or breaking into a system by exploiting unknown software—none of which capture the impersonation through electronic messages that defines phishing.