Phishing
A social engineering attack using fraudulent communications (email, text, voice) to trick recipients into revealing sensitive information, clicking malicious links, or downloading harmful attachments. Phishing begins roughly 16 percent of breaches in Verizon's 2025 data, and AI now assists a large and growing share of phishing attacks.
Defined in 2 GAGE programs, which carry 4 distinct definitions of it. The wording above is taught in Certified AI Practitioner: Workplace Foundations.
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A social engineering attack using fraudulent communications (email, text, voice) to trick recipients into revealing sensitive information, clicking malicious links, or downloading harmful attachments. Phishing begins roughly 16 percent of breaches in Verizon's 2025 data, and AI now assists a large and growing share of phishing attacks.
An attempt to trick a person into revealing sensitive information, such as a password or a one time code, typically through a fake but convincing website, email, or message designed to resemble a real, trusted source.
A social engineering attack where a fraudulent message attempts to trick the recipient into revealing sensitive information or clicking a malicious link. Proofpoint research presented in 2025 found users were 46% more likely to click phishing links generated by large language models than human-written ones.
A fraudulent message that tries to make the recipient click a malicious link, open a malicious attachment, enter credentials on a fake page, or reply with sensitive information. AI made it fluent, personalized, and high-volume.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Digital Readiness Self-Audit · Digital Foundations, Certified AI Practitioner: Workplace Foundations
- Online Safety, Privacy, and Data Basics · Digital Foundations, Certified AI Practitioner: Workplace Foundations
- AI-Specific Threat Detection · AI Security Fundamentals, Certified AI Practitioner: Workplace Foundations
- Your email is the master key: a password manager and two factor · The Hardening Lab, Senior AI Scam Defense
Where it shows up at work
A definition is where Phishing starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Recognizes AI-enabled fraud, from cloned voices and synthetic video to romance and investment scams, and knows the one move that breaks the script.
One lesson on this page teach it as a primary outcome.
Understands prompt injection, data poisoning, model theft, insecure integrations and excessive agent privileges, and the controls that reduce each.
One lesson on this page teach it as a primary outcome.
Builds minimization, purpose limitation, de-identification, consent and retention into an AI system before launch, with tests that prove it.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- AI Privacy Engineerneeds it at depth · 6 open postings this week
- Chief Information Security Officer, AI security focusneeds it at depth
- Chief Technology Officer, AI engineering editionneeds it at depth
- AI Incident Response Leadneeds it at depth · 1 open posting this week
- AI Security Architectneeds it at depth · 8 open postings this week
- AI Governance Engineerneeds it at depth · 7 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: FTC guidance; FinCEN elder financial exploitation advisory; OWASP Top 10 for LLM Applications; Google SAIF.
One interview question about it
A caller sounds exactly like a colleague and asks for a transfer. How do you tell a voice clone from a person, and what is the rule?
Asked of candidates for deepfake, voice-clone and scam recognition. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Elder services, social work, banking front line and fraud teams carries it as a claim to back up: Fraud patterns are familiar; the synthetic versions are new.
- Cybersecurity and IT carries it as a claim to back up: Threat modeling and control design transfer; the AI-specific threats are new.
- A computer science or software engineering degree carries it as a claim to back up: Security fundamentals are a course you took, not yet a control you ran.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.