Glossary
Phishing
Also called: Spear phishing, smishing, vishing
In one sentence
Phishing is a scam message — usually an email, but also texts and phone calls — designed to trick someone into handing over a password, opening malware or sending money.
Phishing messages pretend to come from someone you trust: Microsoft, your bank, a shipping company, an insurance payer, a patient, or your own boss. They create urgency (“your mailbox will be closed today”) and push you to click a link, open an attachment, enter your password or approve something. Spear phishing targets a specific person with researched details; smishing is the text-message version and vishing the phone version.
Today's phishing is harder to spot than the misspelled emails of years past. Attackers send real-looking Microsoft sign-in pages, use shared-document links on legitimate services, and increasingly use AI to write fluent, personalized messages. Some kits even capture the MFA code in real time, which is why phishing-resistant sign-in methods like passkeys matter.
Why it matters: phishing is consistently among the most-reported crimes in the FBI's Internet Crime Complaint Center (IC3) annual reports, and it's a common first step in ransomware and business email compromise. For a practice, one stolen mailbox can expose years of patient emails.
Defenses work best in layers: email filtering, SPF, DKIM and DMARC to stop spoofing, MFA and conditional access to make stolen passwords useless, and short, regular staff training so people know what to report.
Example: the front desk at a dental office receives an email “from” a dental supply vendor with an overdue invoice link. The link opens a fake Microsoft sign-in page. The receptionist notices the web address is wrong and uses the “Report phishing” button instead. The IT team removes the same email from every other inbox in the office.
Test your team with our free Spot the Phish quiz.
Related terms
- Business email compromise (BEC)Business email compromise is a fraud where criminals impersonate or take over a real business email account to trick staff, clients or vendors into sending money or sensitive information.
- MFA (multi-factor authentication)MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
- DMARCDMARC is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks — and sends you reports about it.
- RansomwareRansomware is malicious software that locks or encrypts your files and systems, and often steals copies of your data, so criminals can demand payment to restore access or keep quiet.
- Conditional AccessConditional Access is the Microsoft Entra ID feature that decides, at every sign-in, whether to allow, block or require extra checks based on who is signing in, from what device, and from where.
- PasskeyA password replacement that signs you in with your device’s fingerprint, face or PIN, using cryptography that can’t be phished.