Phishing is a form of social engineering. An attacker pretends to be a bank, shop, email provider, colleague, or another trusted contact and tries to make the user hand over a password, card details, a verification code, or other sensitive information.