phishing

basicwidespread

Phishing is a scam in which the attacker pretends to be a trusted company or acquaintance to extract your password, credit card data, or money.

In plain terms

Imagine someone in a postman's uniform ringing your doorbell and saying they need your apartment key to collect your package. Phishing is the same on the internet: the fraudster does not break the lock but convinces you to hand over the key yourself.

The bait is usually an email, SMS, chat message, or phone call appearing to come from your bank, a courier company, an authority, or your boss. It urges, frightens, or promises a prize so you have no time to think before clicking the link.

Artificial intelligence has changed two things. Language models now write scam letters with near-perfect Hungarian, tailored to individuals, while audio and video forgery can mimic a friend's voice. Additionally, a new target has emerged: the AI agent, which can be deceived by instructions hidden on a website or in an email.

It differs from viruses in that it primarily targets your attention and trust rather than your computer, although the fraudulent message may also carry malicious software. Therefore, the best defense is not just software but habit: if money or passwords are involved, pause and verify through another channel.

How it works

The scammer picks whom to impersonate: they copy the look and branding of a bank, courier company or government office, and register a web address deceptively similar to the genuine one.
It prepares the bait: a message indicating an urgent task, such as a locked account, a stuck package, or an expiring subscription. Today, this is often written by a language model, so it contains no spelling errors.
The message is sent either in bulk or targeted. In the targeted variant, the attacker first gathers your public data to make the email more credible.
If you click, you land on a fake login page where the entered password, card number, or confirmation code immediately goes to the scammer. In other cases, you download malicious software, or are persuaded to make a transfer over the phone.
With the stolen data, the attacker accesses your account, transfers money, or continues writing to your friends in your name, thereby spreading the fraud.

An everyday example

You receive an SMS purporting to come from a courier company: your package could not be delivered, and you must pay a 490 forint surcharge via the attached link. The page looks exactly like the real one, but your card details and the confirmation code you get from your bank go to the scammers, who withdraw the money within minutes.

Who is affected

everyoneAnyone with an email address or phone number will eventually receive a scam message, and a single careless click is enough to cause trouble.

bank customer, investorMany attacks target online banking login credentials and card data because these yield money the fastest. → Money

employeeBy obtaining an employee password, an attacker can access the company's internal systems, making employee mailboxes one of the most common entry points. → Work & HR

entrepreneur, executiveA fake transfer request written in the leader's name or a forged invoice can cause millions in damage with a single occurrence.

A common misconception

MythPhishing messages are easy to spot due to poor Hungarian and a messy appearance.

In realityThis was mostly true in the past, but emails written with language models are now often flawless and personalized. Instead of grammar, pay attention to the sender's real address, the link's destination and the pressure to act urgently.

Limits and risks

The email filter and browser warnings catch many scams, but not all, so neither replaces your own caution.
Two-factor authentication helps a lot but does not make you invulnerable: the fake site can also ask for the confirmation code received via SMS or app and use it immediately. A passkey or hardware security key offers better protection because it only works on the genuine site.
Audio and video are no longer proof, as someone's voice can be cloned from a short recording; when asked for money, call the person back on a number you know.
If you grant an AI agent access to your email or browser, it can also be deceived with hidden instructions; therefore, do not entrust it with payments or data sharing without supervision.

Similar, but not the same

unsolicited email (spam) – Spam is intrusive mass advertising that is mostly just annoying, whereas a phishing message uses deception to steal your data or money.
prompt injection – Prompt injection deceives the language model or agent with hidden instructions, while phishing targets humans, though the two are increasingly combined.
ransomware – Ransomware is malicious software that encrypts your files and demands a ransom; phishing is often just the pathway through which it reaches your device.

Related concepts

Broader

psychological manipulation, cybercrime, online fraud, cybersecurity

Narrower

spear phishing, SMS phishing, Phone phishing, QR code phishing, executive fraud

On the edge

deepfake, voice cloning, prompt injection, Identity theft, two-factor authentication

A brief history

The word phishing emerged in the mid-1990s, when scammers tricked America Online users into revealing passwords. It is a deliberately altered spelling of the English word fishing; the "ph" originates from contemporary hacker slang, specifically the word phreaking, meaning the hacking of telephone networks. Since late 2022, widely available language models have made writing fraudulent messages cheap and linguistically nearly flawless.

Where things stand

At the end of 2026, phishing is one of the most common forms of online fraud, in which personalized messages written with artificial intelligence and cloned voices have become commonplace. A new front has also appeared: instructions hidden in websites and emails to deceive AI agents.

Status: 2026 November

In the news

Appears in 5 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Phishing attack on AI firm Xsolis exposes data tied to 1.4 million patients; nine health systems report impactNov 2, 2026 · Health
Erste reports nearly 21,000 fraud attempts against its customers in six monthsOct 26, 2026 · Money
Microsoft shuts down EvilTokens, an AI-based phishing serviceSep 25, 2026 · Money
ChatGPT phishing: fake "update your payment details" message leads to Stripe pageAug 18, 2026 · Money
AI-powered vishing wave hits Wall Street firmsAug 5, 2026 · Money

Also known as

phishing · phishing · phishing attack · phishing email · spear phishing · smishing · vishing · quishing

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.