PARAGRAPH: What is phishing ?
Phishing is one of the easiest forms of cyberattack for criminals to carry out, and one of the easiest to fall for. It’s also one that can provide everything hackers need to ransack their targets’ personal and work accounts.
Usually carried out over email – although the phishing scam has now spread beyond suspicious emails to phone calls (so-called ‘vishing’) social media, messaging services (aka ‘smishing’) and apps – a basic phishing attack attempts to trick the target into doing what the scammer wants. That might be handing over passwords to make it easier to hack a company, or altering bank details so that payments go to fraudsters instead of the correct account.
Phishing is also a popular method for cyber attackers to deliver malware, by encouraging victims to download a document or visit a link that will secretly install the malicious payload in attacks that could be distributing trojan malware, ransomware or all manner of damaging and disruptive attacks. The aim and the precise mechanics of the scams vary : for example, victims might be tricked into clicking a link through to a fake web page with the aim of persuading the user to enter personal information – it’s estimated that an average of 1.4 million of these websites are created every month.
More complex phishing schemes can involve a long game, with hackers using fake social media profiles, emails and more to build up a rapport with the victim over months or even years in cases where specific individuals are targeted for data that they would only ever hand over to people they trust.
That data can range from personal or corporate email address and password, to financial data such as credit card details or online banking credentials or even personal data such as date of birth, address and a social security number.
How does a phishing attack work ?
A basic phishing attack attempts to trick a user into entering personal details or other confidential information, and email is the most common method of performing these attacks.
The sheer number of emails sent every single day means that it’s an obvious attack vector for cyber criminals. It’s estimated that 3.7 billion people send around 269 billion emails every single day.
Researchers at Symantec suggest that almost one in every 2,000 of these emails is a phishing email, meaning around 135 million phishing attacks are attempted every day.
Most people simply don’t have the time to carefully analyse every message that lands in their inbox – and it’s this that phishers look to exploit in a number of ways.
Scams vary in their targets – some are aiming at unwary consumers. Here, their email subject line will be designed to catch the victim’s eye – common phishing campaign techniques include offers of prizes won in fake competitions such as lotteries or contests by retailers offering a ‘winning voucher’.
In this example, in order to ‘win’ the prize, the victims are asked to enter their details such as name, date of birth, address and bank details in order to claim. Obviously, there’s no prize and all they’ve done is put their personal details into the hands of hackers.
