Explain like I'm five · Security

What is Phishing?

Phishing, told as a story about a letter that pretends to come from the post office.

✓✓✓post officemarketa friendmost of them are real

Letters arrive at the castle every day.From the post office, the market, a friend… most of them are real.

a thief in post-office blue?From the post officeA parcel! Today onlyCome here and show your keyA parcel? Better hurryurgent, scary, or too good to be true

The thief sends a letter dressed as the post office.'A parcel, today only, come here.' Urgent, scary, or too good to be true.

?the fake gateMy password is apple!no wall is broken, no lock picked — I open the door myself

Phishing pretends to be someone you trust, and gets you to hand over the key.No wall is broken, no lock picked. It gets me to open the door myself.

A familiar facethe post office, the boss, the bank
Hurry!today only, or else
The fake gatea door that looks just right
I open it myselfthe thief breaks nothing
?the letteremailParcel arrived → linkthe textsmishingthe callvishing?Dear JiminThe boss needs you nowaimed at youspear phishingknowing your name and your boss's makes it far more convincing

It isn't only letters.By text (smishing), by phone (vishing), and aimed at you by name, boss and all (spear phishing).

?from: post-offlce.kr?the ring stays darkcheck the envelope, pause at the doorI was in a hurry…one in a hundred still falls for itso there's a bell for reporting odd letters

Check the envelope, and pause at the door.Is the sender real, is the gate real. The ring stays dark at a fake gate. Still, one in a hundred falls for it — so there's a bell for reporting odd letters.

In one breath

Phishing = a letter pretending to be someone you trust, so you hand over the key or walk into a fake gate. It doesn't break the wall — it fools you.

Phishing is T1566 in the encyclopedia — the most common first step of a break-in. Defenses: training, a reporting bell, a ring that stays dark at fake gates (passkeys), and the real post office's stamp (SPF, DKIM, DMARC).

When grown-ups say it

Spear phishing
Aimed at one person. Written knowing your name, your boss, what you're working on.
Smishing
The text-message letter. 'Parcel arrived → link'. On a phone, you tap faster.
Vishing
The call. A voice pretending to be the post office, the bank, the police.
Phishing site
The look-alike door. Put the key in here and it goes to the thief. → the gatekeeper story
Sender address
Who it's really from. post-office.kr and post-offlce.kr — one letter apart.
SPF · DKIM · DMARC
The real post office's stamp. The directory records which post offices may send in my name.
Report button
The odd-letter bell. One ring and the guard room pulls the letter from everyone. → the guard room
T1566
Its number in the encyclopedia. → the burglar encyclopedia
Next story
The Bug in the Gift Box →
Want another term as a picture book? Request →