A social engineering attack in which a fraudster impersonates a trusted entity—such as a bank, employer, or government agency—through email, text message (smishing), or voice call (vishing) to trick victims into revealing sensitive information, clicking malicious links, or transferring funds. Phishing is the most common initial attack vector for account takeover, business email compromise, and credential theft.