Phishing

Phishing is a social-engineering attack that tricks users into revealing credentials, OTPs, or sensitive data via deceptive emails, sites, calls, or SMS. Variants include spear-phishing (targeted), business email compromise (BEC), smishing (SMS), and vishing (voice). In finance, phishing drives account takeover, payment fraud, and internal breaches.Controls include passkeys/MFA, DMARC/SPF/DKIM, secure email gateways, URL detonation, and continuous user training/simulations. Incident response should cover rapid credential revocation, session invalidation, and forensic review. From a compliance lens, phishing impacts customer protection, data privacy, and operational resilience obligations.