Phishing is a technique of fraudulently obtaining private information,…

The idea

Phishing is a social-engineering attack: the criminal deceives the victim into handing over private information rather than breaking in technically. The fraud works by impersonating a trusted organisation, such as a bank or delivery firm, and pressuring the recipient to act. Email is the classic channel, but SMS is equally valid and is often called smishing. A typical message claims a problem with an account and supplies a link to a fake login page that captures the typed username and password. Recognising phishing means checking the sender address, the tone of urgency, unexpected links and requests for credentials. The defining features to learn are deception, the goal of obtaining private information, and the use of messaging channels such as email or SMS.

What earns the marks

• Identifies phishing as a form of social engineering that relies on deception rather than technical intrusion.
• States that the attacker fraudulently obtains private information such as passwords, PINs or bank details.
• Recognises email as a common channel for phishing messages.
• Recognises SMS as a common channel, sometimes called smishing.
• Explains the mechanism: a fake message or link leads the victim to reveal information to the attacker.
• Distinguishes phishing from other threats such as malware or brute-force attack.

Common mistakes and how to put them right

• Confusing phishing with a technical attack such as a virus.

  Put it right: Phishing manipulates the person into giving information away.

• Assuming phishing only happens by email.

  Put it right: SMS and other messaging channels are also used.

• Thinking the attacker directly hacks the account.

  Put it right: The victim is tricked into supplying the credentials.

• Ignoring the 'private information' element.

  Put it right: The purpose is to obtain confidential data, not merely to annoy the user.

Exam tips

• Link the definition to deception and to obtaining private information, since both parts are needed for full credit.
• Give a concrete example, such as a fake bank email with a link to a bogus login page, to show understanding.
• Mention SMS as well as email so the answer covers the full statement.
• Use the correct term for SMS phishing (smishing) if you can, but do not rely on it alone.