0. (Not refactoring). Making the minimum necessary change.
This is often expedient and may feel safest, where safety = not breaking existing functionality, and not getting yelled at.
1. Doing more than the minimum necessary change.
You could hack in your bug fix or new feature. Maybe that's hard because the code is already convoluted. Or maybe your hack would make the code convoluted. So you clean things up a bit at the same time.
2. Cleaning up code without changing existing behavior.
At least, you hope you're not changing behavior.
3. A highly disciplined process of known-safe code transformations.
Within a method body I feel confident that I can rename a local variable with Search/Replace if I first check that the new name isn't already in use.
Feather’s book (aka WELC) includes some highly-detailed methods of doing this to legacy code to get it to the point where you can start writing unit tests. By detailed, I mean tedious.
For example, select a line of code, RClick, Extract Method.
Only #3 and #4 are safe enough that I do them without fear.
My preference is to do #4, over and over again. (Also, I commit each one separately.)
Some will say that #1 and #2 aren't "true refactoring". I find that arguing about definitions to be counterproductive and off-putting. Each of these activities have value in some context, and each are worth discussing. However, it should be noted that Martin Fowler is one of those people.