# Phishing > Phishing is a type of fraud in which an attacker sends a message that pretends to come from a trusted sender in order to trick the recipient into revealing passwords, approving payments, or opening a malicious link or file. Also called: phishing email, spear phishing, business email compromise, email scam. Most phishing arrives by email, though text messages, phone calls, and QR codes are used too. The message copies a familiar brand, a supplier, or a colleague and creates urgency: an unpaid invoice, a locked account, a shared document. The link leads to a fake sign-in page that captures the password, or the attachment installs malware. Targeted versions aimed at one person are called spear phishing. Small businesses are targeted because one captured mailbox is enough to do real damage. From inside it, an attacker can read invoices, reply to real conversations, and ask customers to pay into a different bank account. This is known as business email compromise, and it often goes unnoticed until money is missing. Anyone can be caught by one convincing message on a busy day. No single control stops phishing, so layer them: email filtering, multi-factor authentication on every account, SPF, DKIM, and DMARC to stop others faking your domain, and short, regular staff training. Agree on a rule that any change of bank details is confirmed by phone using a known number. Make reporting a suspicious message easy and blame-free. We configure email filtering and sign-in protection as part of our security services. ## Where we do this work - [Cybersecurity services](https://techpitsolutions.systems/services/cybersecurity) - [Email and DNS deliverability](https://techpitsolutions.systems/services/email-dns-deliverability) ## See also - [Multi-factor authentication (MFA)](https://techpitsolutions.systems/glossary/multi-factor-authentication): Multi-factor authentication (MFA) is a sign-in method that requires two or more different kinds of proof, such as a password plus a code from a phone app or a physical security key, before it grants access to an account. - [DMARC](https://techpitsolutions.systems/glossary/dmarc): DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS policy that tells receiving mail servers what to do with messages that fail SPF and DKIM checks for a domain, and where to send reports about them. - [Endpoint detection and response (EDR)](https://techpitsolutions.systems/glossary/endpoint-detection-and-response): Endpoint detection and response (EDR) is security software that continuously records activity on laptops, desktops, and servers, detects suspicious behavior, and lets responders investigate and isolate an affected device. --- Source: https://techpitsolutions.systems/glossary/phishing TechPit Solutions ยท Run by AI, backed by real people. A remote team working with businesses in the US, UK, Canada, Australia, New Zealand and Europe. Email info.techpit.co@gmail.com, WhatsApp +92 344 3360585. Book a 15-minute call: https://techpitsolutions.systems/contact