How do phishing attacks manipulate people into revealing passwords or financial information?

In the context of cyberwar, phishing is classified as a semantic cyberattack, or a form of social engineering, that exploits human psychology rather than technical vulnerabilities alone.1

Attackers manipulate users by sending deceptive emails that appear to originate from reputable sources, such as banks, credit card providers, or trusted colleagues. These messages often create a sense of urgency or legitimacy, inviting the recipient to "update" or "confirm" account details. By clicking provided links, victims are directed to fraudulent websites meticulously designed to mimic familiar, legitimate platforms.231

Once on these sites, users are prompted to enter sensitive data—such as passwords, Social Security numbers, or financial information—under the guise of a routine security check. This stolen information is then used for criminal activities, including identity theft or unauthorized access to secure networks. Ethically, these deceptive practices are predatory, as they weaponize trust to compromise individual security and organizational integrity.213