Phishing is an online scam where the cyber criminal impersonates a trustworthy entity in order to obtain the victim’s sensitive data.
Types of phishing scams
Phishing has been around for years and in that time, attackers have developed a wide array of methods to target victims.
The most common phishing technique is to impersonate a bank or financial institution via email, to lure the victim either into completing a fake form in – or attached to – the email message, or to visit a webpage requesting entry of account details or login credentials.
Similar attacks can also be performed via phone calls (vishing) as well as SMS messages (smishing).
In the past, misspelled or misleading domain names were often used for this purpose. Today, attackers incorporate more sophisticated methods, making the links and fake pages closely resemble their legitimate counterparts.
Information stolen from the victims is usually misused to empty their bank accounts or is sold online.
A more advanced phishing method whereby seemingly authentic phishing messages land in the inboxes of specific groups, organizations or even individuals. Authors of spearphishing emails perform detailed research on their target(s) in advance, making it difficult to identify the content as fraudulent.
Attacks focused on specific, mostly high-profile business individuals – such as top managers or owners – are labeled as “whaling”, due to the size of the potential pay-off (the bad guys going after “the big fish”).
A form of phishing, smishing is when someone tries to trick you into giving them your private information via a text or SMS message. Smishing has now become an emerging and growing threat in the world of cyber security. This form of phishing is particularly alarming because people tend to be more inclined to trust a text message than an email.
Deceptive phishing is the most frequent type of phishing attack. In this case, the attacker attempts to obtain confidential information from the victims. Attackers then use the information to steal money or to launch other attacks. A email from a trusted company such as a bank asking you to visit a link and verify your account details is an example of deceptive phishing.
When attackers go after a “big fish” like a CEO or similar, it’s called whaling. These attackers often spend a considerable amount of time profiling the target to find the opportune moment and means of obtaining their credentials. High-level executives are able to access a great deal of company information so whaling is of particular concern.
Similar to phishing, pharming sends users to a fraudulent website that appears to be legitimate. However, in this case, victims do not even have to click a malicious link to be taken to the dishonest site. Attackers can infect either the user’s computer or the website’s DNS server and redirect the user to a false website even if the correct URL is typed in.
How to recognize phishing
An email or electronic message can contain official logos or other signs of a reputable organization and still come from phishers. Below are a few hints that can help you spot a phishing message.
- Generic or informal greetings – If a message lacks personalization (e.g. “Dear Customer”) and formality then there is probably something amiss. The same applies to pseudo-personalization using randomized, fake reference numbers
- A request for personal information – Frequently used by phishers, usually avoided by banks, financial institutions and most online services
- Poor grammar – Spelling mistakes, typos and unusual phrasing often indicates a fake (but the absence of any of these is not proof of legitimacy)
- Unexpected correspondence – Unsolicited contact from a bank or online service provider is highly unusual and thus suspicious
- A sense of urgency – Phishing messages often try to induce rapid and less-considered action
- An offer you cannot refuse? – If the message sounds too good to be true, it almost certainly is.
- Suspicious domain – Would a US or German bank really send an email from a Chinese domain?
How To Prevent Phishing
To avoid a phishing bait, be aware of the above indicators by which phishing messages commonly give themselves away.
Follow these simple steps
- Be aware of new phishing techniques: Follow the media for phishing attack reports, as the attackers might come up with new techniques for luring users into a trap
- Don’t give away your personal details: Always be alert if an electronic message from a seemingly trustworthy entity asks for your credentials or other sensitive details. If necessary, verify the contents of the message with the sender or the organization they seemingly represent (using contact details known to be genuine rather than details provided in the message)
- Think twice before you click: If a suspicious message provides a link or attachment, don’t click or download. Doing so might lead you to a malicious website or infect your device with malware
- Check your online accounts regularly: Even if you don’t suspect that someone is trying to steal your credentials, check your banking and other online accounts for suspicious activity. Just in case…
- Apply these techniques and ‘Enjoy Safer Technology’