What is phishing, and what variants exist beyond classic email phishing?

Phishing tricks people into handing over confidential data by impersonating a trusted party — and it now spans voice, QR codes, and more.

The word blends Password + fishing. Attackers pose as trustworthy institutions (e.g. your bank) and exploit people's trust and helpfulness to harvest credentials or account details.

Variants:

• Vishing — voice phishing (phone calls)
• QR-phishing (quishing) — malicious QR codes leading to fake login pages
• Smishing — via SMS
• Spear phishing — targeted at a specific person/role

Why it works: it attacks the human pillar, bypassing technical controls entirely — no exploit needed if the victim just types in their password.

Tip: Phishing is a form of social engineering — #3 on the ENISA threat list — and the most common initial-access method in real breaches.