What is Phishing? How do phishing scams work?

Understanding Phishing: A Cybersecurity Threat

Phishing is a misleading practice that endangers individual and organisational security by manipulating people into revealing private data, installing destructive software, and becoming victims of cybercrime.

How Phishing Works:

Phishing includes the use of misleading emails, texts, calls, or websites.

People are tricked into:

• Installing Malware: Unconsciously downloading software that hurts their devices.
• Disclosing Private Data: Providing sensitive details such as Social Security numbers, credit card data, bank details, and login credentials.
• Compromising Security: Undertaking activities that risk individual or organisational cybersecurity.

Results of Phishing:

• Identity Theft: Unapproved use of individual data.
• Financial Fraud: Illicit access and use of credit card and banking information.
• Ransomware and Data Breaches: Infiltration leading to data theft and ransom demands.
• Significant Losses: Significant financial and reputational harm to people and businesses.

The Role of Social Engineering:

1. Manipulation Techniques:

Phishing is a prime example of social engineering, which exploits human psychology to deceive and coerce casualties into making security errors.

2. Impersonation:

Attackers regularly pose as trusted entities, such as colleagues, bosses, or recognizable organisations, to gain the victim’s trust.

3. Urgency and Pressure:

Making a false sense of urgency, attackers push casualties to act without due diligence.

4. Human Vulnerability:

These strategies are favoured by cybercriminals as they are less difficult and more cost-effective than direct hacking attempts.

Different kinds of phishing attacks:

1. Bulk phishing emails:

Bulk email phishing is the most common type of phishing attack. Here, a scammer creates an email that looks like it’s from a big, well-known company or organisation, such as a bank, online store, or popular software maker. They send this email to millions of people at once. They do this because the more people they send it to, the higher the chance that some will fall for the scam. These emails usually try to get personal information like passwords or credit card numbers.

2. Spear phishing:

Spear phishing targets a specific person, usually someone with important access to sensitive data or computer systems. The scammer does some research on the target to make the email seem trustworthy. They might pretend to be someone the target knows, like a friend, boss, or colleague. They often get information from social media where people share a lot about themselves. Then, they use this information to craft a convincing email that tricks the target into giving away sensitive information or clicking on harmful links.

3. Business email compromise (BEC):

BEC is a type of spear phishing aimed at stealing a lot of money or valuable information from big companies or institutions. There are two common forms of BEC:

CEO fraud: The scammer pretends to be a high-ranking executive and sends an email to someone lower down in the company, telling them to transfer money to a fake account or make a purchase from a fake vendor.

4. Email account compromise (EAC):

The scammer hacks into a lower-level employee’s email account, like someone in finance or sales. Then, they use that account to send fake invoices or requests for money to other employees or vendors.

Often, the scammer gets access to these email accounts by sending a fake email to an employee, tricking them into giving away their login details. For example, they might send a message saying, “Your password is expiring, click here to update it,” but the link actually leads to a fake website designed to steal their information.

Other ways of phishing:

SMS Phishing (Smishing):

This can happen when scammers send fake messages to your phone. They might pretend to be your phone company or a benefit you utilise, like Netflix, and inquire for personal data or payment details.

Voice Phishing (Vishing):

Rather than writing, scammers might call you. They can use innovation to make it look like they’re calling from an authentic number or organisation. They might say your bank account includes an issue; otherwise, you owe cash, which will frighten you into giving them data.

Social media phishing:

Scammers can also use social media to trap individuals. They might send fake messages or emails that look like they’re from a companion or a social media location. They’ll inquire for your password or payment details.

Application or in-app information:

In some cases, scammers send fake emails that look like they’re from apps or administrations use. They might imagine it to be from PayPal or Microsoft Office and inquire for your data.

Securing against phishing tricks is vital for keeping your individual data secure. One way to achieve this is by practising security awareness, being prepared, and maintaining a few best practices.

Organisations should teach their employees how to recognize phishing scams. These are fake messages that try to trick you into giving away sensitive information, like your password or credit card number. Here are some things to look out for:

• Be careful if an email asks for personal information or to update your account details.
• Don’t respond to emails that ask you to send money or move funds.
• Be suspicious of unexpected file attachments in emails.
• Watch out for emails that try to scare you into acting quickly, like saying your account will be closed.
• Look for poor spelling or grammar in the email.
• Check if the sender’s email address looks strange or doesn’t match who they claim to be.
• Be cautious of shortened links, as they might lead to dangerous websites.
• Be wary of emails that use images instead of text.
• Remember, this is not a complete list, as hackers are always coming up with new ways to trick people. Organisations can stay updated on the latest phishing trends by reading reports like the Anti-Phishing Working Group’s quarterly report.

To make it easier for employees to identify phishing attempts, organisations can also set up some rules. For example, they can make it clear that no one in the company will ever ask for money transfers via email. They can also ask employees to double-check any requests for personal information by contacting the sender directly or visiting the official website, instead of clicking on links in the email. Lastly, employees should be encouraged to report any suspicious emails to the IT or Security department. This way, everyone can work together to keep the organisation safe from phishing scams.