Phishing depends only on technical software weaknesses and does not use social manipulation.

### Why this is right The statement is false because phishing uses deception and social engineering to persuade people to reveal information, open attachments, visit malicious links, or make damaging transfers. ### The concept Phishing messages often imitate a trusted person or organization and may use urgency or fear to prompt a quick response. Email is common, but the course also identifies text-message phishing and voice phishing. Technical controls such as filtering and multi-factor authentication help, while user reporting and training support detection. Phishing is therefore a human-directed attack method, even when it ultimately compromises a technical account or system. ### The other options - **The statement is false**: Phishing's defining mechanism includes manipulation of a recipient, not just exploitation of software. ### Terms - **Social engineering**: Manipulating people into actions that may undermine security or their interests. - **Multi-factor authentication (MFA)**: Requiring more than one kind of proof to verify a user's identity. ### Remember Phishing targets decisions as well as devices.