Skip to main content
Commerce Security Authority
Category: Fraud Typologies

Phishing

Simply put

Phishing is an online scam in which attackers send fraudulent emails, text messages, or web pages that appear to come from a trusted source in order to trick people into revealing sensitive information. This information can include passwords, account numbers, credit card numbers, or Social Security numbers. The goal is typically to steal money or a person's identity.

Formal definition

Phishing is a social-engineering technique that attempts to acquire sensitive data, such as usernames, passwords, bank account numbers, or payment card numbers, through fraudulent solicitation delivered via email, text message, or a spoofed web site that impersonates a well-known or trusted entity. In a payment context, phishing may target authentication credentials and cardholder data, though the specific data sought depends on the attacker's objective. Phishing is one vector among several used to enable downstream fraud such as account takeover or identity theft; it exploits human trust rather than a technical vulnerability alone, and no single control fully eliminates it.

Why it matters

Phishing matters because it targets people rather than technology, exploiting human trust to acquire credentials and sensitive data that attackers can then use to commit fraud. In a payment context, a successful phishing attack may yield authentication credentials, account numbers, or cardholder data, which can feed downstream activity such as account takeover or identity theft. Because the attack exploits human decision-making rather than a specific technical vulnerability, controls that harden systems do not, on their own, eliminate the risk.

Phishing is one vector among several, and it is often an early step in a longer chain of fraud rather than the fraud itself. The data an attacker seeks depends on their objective: some campaigns pursue login credentials for accounts, while others target payment card numbers or personal identifiers. This variability means that defenders should treat phishing as an enabling technique that can precede multiple distinct fraud outcomes, and should assess exposure across the specific data types their environment handles.

No single control fully eliminates phishing, and detection approaches carry trade-offs between false positives, which can block legitimate messages, and false negatives, which let fraudulent messages through. Effective mitigation typically combines user awareness, technical filtering, and authentication measures, while recognizing that determined attackers adapt their lures over time.

Who it's relevant to

Fraud analysts and merchant risk teams
Phishing is frequently an upstream enabler of the fraud that these teams investigate, including account takeover and identity theft. Understanding that phishing precedes and feeds later fraud helps analysts connect suspicious account activity to a likely credential-compromise origin rather than treating incidents in isolation.
Security engineers
Because phishing exploits human trust rather than a single technical vulnerability, engineers should combine technical filtering, spoofing defenses, and authentication measures while recognizing that no single control fully eliminates the risk and that detection filtering involves false-positive and false-negative trade-offs.
Compliance officers
Phishing targets authentication credentials and cardholder data that fall within the scope of data-protection obligations. Compliance teams should account for social-engineering risk in awareness programs and control assessments, noting that phishing addresses a human-facing threat distinct from purely system-level controls.
Acquirers and payment processors
Phishing campaigns that target payment card numbers and account credentials can drive downstream card-not-present fraud and account takeover across the payment chain. Awareness of phishing as an enabling vector supports risk monitoring and customer-facing guidance, without implying that any single measure eliminates the underlying threat.

Inside Phishing

Social engineering lure
The deceptive message or pretext, often delivered by email, SMS (smishing), or voice (vishing), that impersonates a trusted party to manipulate the recipient into acting against their own interest.
Credential harvesting page
A fraudulent website designed to mimic a legitimate login or payment page, intended to capture entered credentials or cardholder data. Note that capturing sensitive authentication data such as CVV2/CVC2/CAV2/CID or PINs is a common phishing goal, and such data must never be stored after authorization by legitimate entities.
Payload or malicious link/attachment
The mechanism that either directs the victim to the harvesting page or delivers malware. The immediate objective may be theft of cardholder data (such as PAN, expiration date) or of authentication factors.
Target selection
The intended victims, ranging from broad untargeted campaigns to spear phishing aimed at specific individuals and business email compromise aimed at employees with access to payment or account systems.
Follow-on abuse
Use of harvested data to enable downstream fraud, which may include account takeover, card-not-present fraud, or use of stolen credentials to access systems in scope for PCI DSS.

Common questions

Answers to the questions practitioners most commonly ask about Phishing.

Does phishing only happen through email?
No. While email is a common vector, phishing also occurs through SMS text messages (often called smishing), voice calls (vishing), messaging apps, social media, and fraudulent websites reached via search results or malicious ads. Treating phishing as an email-only problem can leave other channels unmonitored and users unprepared for solicitations that arrive by phone or text.
Isn't phishing just poorly written messages that are easy to spot?
Not reliably. The assumption that phishing always contains obvious spelling errors or crude formatting is a misconception. Many campaigns closely imitate legitimate branding, use accurate logos, and reference real transactions or account details. Targeted approaches directed at specific individuals or roles may be well researched and contextually convincing, so visual polish alone is not a dependable indicator of legitimacy.
What technical controls help reduce the likelihood that phishing messages reach users?
Email authentication mechanisms such as SPF, DKIM, and DMARC help receiving systems evaluate whether a message genuinely originates from a claimed domain, which may reduce spoofed messages. Gateway filtering, link inspection, and attachment analysis can further limit delivery. These controls help reduce exposure but do not eliminate it, since attackers adapt techniques and may use look-alike domains or channels outside email filtering.
How can multi-factor authentication limit the impact of a successful phishing attempt?
If a user's credentials are captured through phishing, multi-factor authentication is intended to add a further verification step that an attacker must also satisfy, which may mitigate account takeover. However, some phishing techniques attempt to intercept or relay authentication factors in real time, so MFA reduces rather than removes the risk. Phishing-resistant authentication approaches are intended to address certain of these relay techniques.
What role does user awareness training play, and what are its limitations?
Awareness training is intended to help users recognize suspicious solicitations and follow reporting procedures. It can complement technical controls but should not be relied on as the sole defense, because convincing campaigns may deceive even trained users. Effective programs are typically reinforced by clear reporting channels and by technical layers, since human judgment alone is subject to error under time pressure or realistic pretexts.
How should an organization handle a reported phishing attempt that may have exposed payment or account data?
A defined incident response process helps ensure reports are triaged, potentially affected credentials or accounts are reviewed, and containment steps are taken according to established procedures. Where payment card data may be involved, organizations should assess obligations under applicable card brand and network rules and any relevant compliance requirements, confirming specific reporting timelines and steps against current published sources rather than assuming a fixed procedure.

Common misconceptions

Multi-factor authentication makes phishing harmless.
MFA can help reduce the impact of stolen passwords, but it does not eliminate phishing risk. Some phishing techniques target one-time codes, use real-time relay of credentials, or exploit push-approval fatigue. MFA is intended to raise the difficulty of account takeover, not to guarantee prevention.
Only email counts as phishing.
Phishing spans multiple channels, including SMS (smishing), voice calls (vishing), and messaging platforms. Focusing controls on email alone leaves other vectors unaddressed.
Phishing awareness training prevents all successful attacks.
Training may reduce click rates and reporting delays, but it cannot guarantee that no user will be deceived. Effective programs assume some attempts will succeed and layer detection and response controls accordingly; awareness metrics vary by source, period, and methodology.

Best practices

Deploy layered technical controls, such as email authentication mechanisms, link and attachment filtering, and web filtering, recognizing that no single control blocks all attempts and that false positives and false negatives are trade-offs to be tuned.
Implement phishing-resistant authentication where feasible for accounts that access systems handling cardholder data, and treat MFA as a risk-reduction measure rather than a complete safeguard.
Provide role-appropriate awareness training and a low-friction reporting path so suspected messages can be triaged quickly, while assuming some attempts will still succeed.
Ensure that no sensitive authentication data (such as full track data, CVV2/CVC2/CAV2/CID, or PINs) is retained after authorization, so that a successful phishing incident cannot expose stored copies of such data.
Maintain an incident response process for credential compromise, including rapid credential resets, session invalidation, and monitoring for account takeover and card-not-present fraud indicators.
Verify anti-phishing and access controls against the current published PCI DSS requirements applicable to your environment rather than assuming a fixed requirement number, since numbering and wording differ between versions.