Phishing

Imagine your phone buzzes with an urgent text. It says "Your package address is incorrect" or "An overseas payment has been completed." Startled, you tap the link without thinking. A login page appears that looks exactly like the website or bank you use every day.

The moment you type in your username, password, and account number without a doubt, that information doesn't go to the real service. It goes straight to a scammer's computer. Instead of hacking a complex computer system, the scammer throws out bait that preys on your anxiety and gets you to open the door yourself.

In the end, the victim hands over their own personal information with their own hands. No matter how strong a security firewall is, it can fall easily when someone exploits a single careless click.

Phishing has moved far beyond plain email. It now spreads through almost every way we communicate day to day. Tricking people with a fake link sent by text message is called smishing. Calling someone and posing as a prosecutor or an official from a financial regulator (in Korea, the Financial Supervisory Service) is called vishing, or voice phishing.

Then there's pharming. Even if you type a legitimate web address correctly, the scammer has rigged things so you get sent to a fake site anyway. There's also spear phishing. Instead of targeting just anyone, the scammer digs into a specific person or organization, such as a company's employees, and sets a custom-made trap.

An urgent request or special offer from an unclear source is often a trap the scammer has dug for you. That's why checking the address before you click a link is a handy shield. But some tricks, like pharming, fool you even when the address looks right, so that habit alone can't stop everything.

In the security world, phishing is classified as "social engineering." That means it tricks people directly rather than exploiting a technical flaw in a system. Encryption and firewalls can be very tough. But feelings like curiosity or fear are hard to block with a logical shield, and phishing takes advantage of exactly that.

Even if you've made a complex, secure password, the security system can be disabled in an instant if an administrator is fooled into handing the password to a scammer. Controlling human behavior and psychological slip-ups is far harder than fixing computer code.

That's why modern security doesn't rely on a password alone. Two-step verification is the baseline: a one-time code sent to your phone, or a biometric check. Even if your password leaks, an extra proof of identity in your own hand serves as the last line of defense.