phishing - Glossary | CSRC (2024)

Definitions:

A technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a web site, in which the perpetrator masquerades as a legitimate business or reputable person.
Sources:
CNSSI 4009-2015 from IETF RFC 4949 Ver 2
NIST SP 800-12 Rev. 1 under Phishing from IETF RFC 4949 Ver 2

Tricking individuals into disclosing sensitive personal information through deceptive computer-based means.
Sources:
NIST SP 800-150 under Phishing from NIST SP 800-88 Rev. 1
NIST SP 800-45 Version 2 under Phishing
NIST SP 800-83 Rev. 1 under Phishing

A digital form of social engineering that uses authentic-looking—but bogus—e-mails to request information from users or direct them to a fake Web site that requests information.
Sources:
NIST SP 800-115 under Phishing

Using social engineering techniques to trick users into accessing a fake Web site and divulging personal information.
Sources:
NIST SP 800-44 Version 2 under Phishing

An attack in which the Subscriber is lured (usually through an email) to interact with a counterfeit Verifier/RP and tricked into revealing information that can be used to masquerade as that Subscriber to the real Verifier/RP.
Sources:
NIST SP 1800-21B under Phishing from NIST SP 800-63-3
NIST SP 800-63-3 under Phishing

An attack in which the subscriber is lured (usually through an email) to interact with a counterfeit verifier or relying party and tricked into revealing information that can be used to masquerade as that subscriber to the real verifier or relying party.
Sources:
NIST SP 1800-17b under Phishing

Tricking individuals into disclosing sensitive personal information by claiming to be a trustworthy entity in an electronic communication (e.g., internet web sites).
Sources:
NIST SP 800-82r3

Glossary Comments

Comments about specific definitions should be sent to the authors of the linked Source publication. For NIST publications, an email is usually found within the document.

Comments about the glossary's presentation and functionality should be sent to secglossary@nist.gov.

See NISTIR 7298 Rev. 3 for additional details.