Phishing
Pronunciation: FISH-ing
Definition
Phishing is a social-engineering attack that tricks people into revealing credentials, approving malicious transactions or visiting counterfeit services.
Overview
What it means
Phishing is a social-engineering attack that tricks people into revealing credentials, approving malicious transactions or visiting counterfeit services. In cryptocurrency it often targets wallet recovery phrases, signing prompts, payout settings and exchange logins.
How it works
Attackers imitate legitimate websites, emails, support agents or QR codes. They may use lookalike domains and urgent messages to persuade a merchant to enter secrets or authorize a wallet signature. Protection depends on trusted bookmarks, independent communication channels, transaction review, MFA and limiting credential privileges.
Understanding the technical details
Verify the destination of every login or signing request through an independently known route. In crypto, a link can be fraudulent even when it correctly names the user’s wallet or recent transaction, since on-chain activity is public. A suspicious support message may ask for a seed phrase, a new payout address, a token approval or a verification signature. Teach staff to stop and confirm through a trusted channel, not through contact details in the suspicious message.
Common failures and limitations
Not every phishing attack asks for passwords; some ask users to sign a token allowance or change a refund destination. Browser padlock icons do not prove a website is trustworthy. Recovery phrases should never be entered into support forms.
Related concepts
Private Key, Webhook Signature, Crypto Payment Fraud.
Further reading
Example
A finance manager receives a message claiming the gateway’s payout API key will expire in ten minutes. The linked website copies the real login page. Using the known website URL independently prevents the credential from being sent to the attacker.
Comparison
Phishing manipulates the victim into acting. Malware performs unauthorized actions through software, while address poisoning exploits confusing transaction-history entries; several attack methods can be combined.
Key Takeaway
Not every phishing attack asks for passwords; some ask users to sign a token allowance or change a refund destination.
Sources
- Recognize and Report Phishing — Cybersecurity and Infrastructure Security Agency (2026-08-03)
- Digital Identity Guidelines: Authentication and Authenticator Management, SP 800-63B-4 — NIST (2026-08-03)
- Business Email Compromise — FBI Internet Crime Complaint Center (2026-08-03)