Avery common social engineering tactic in which the attacker creates an authentic-looking e-mail or web page that convinces users to enter their confidential information or install software on their computer that secretly records information and sends it back to the attacker.