A phishing scam is a fraudulent attempt to obtain sensitive information or data, such as usernames, passwords, or credit card details, by impersonating a trustworthy entity in digital communication. For example, phishing is often done by email and impersonates an expired login or additional verification. After entering your information, you discover that the website was not legitimate. If you create or send a phishing scam, you may be subject to major penalties as it is a violation of federal law.