Phishing is a cybersecurity attack where criminals send fraudulent emails, text messages, or create fake websites designed to trick recipients into revealing passwords, financial information, or other sensitive data. Phishing messages often impersonate trusted organizations like banks, government agencies, or technology companies. Municipal employees are common targets since gaining access to government systems can enable further attacks or access to resident data. Effective defences include employee training to recognize phishing attempts, technical filters blocking suspicious messages, multi-factor authentication reducing password compromise impact, and clear reporting procedures for suspicious communications. Phishing remains one of the most common initial attack methods.