Phishing is a social engineering attack that succeeds by tricking users into taking action - clicking links, entering credentials, downloading malware, or performing transactions. The attack exploits human psychology rather than technical vulnerabilities.