What is Phishing?

A more advanced phishing method whereby seemingly authentic phishing messages land in the inboxes of specific groups, organisations or even individuals. Authors of spearphishing emails perform detailed research on their target(s) in advance, making it difficult to identify the content as fraudulent.

Attacks focused on specific, mostly high-profile business individuals – such as top managers or owners – are labelled as “whaling”, due to the size of the potential pay-off (the bad guys going after “the big fish”).

A type of phishing, smishing is when someone tries to trick you into giving them your private information via a text or SMS message. Smishing has now become an emerging and growing threat in the world of cybersecurity. This form of phishing is particularly alarming because people tend to be more inclined to trust a text message than an email.

Deceptive phishing is the most frequent type of phishing attack. In this case, the attacker attempts to obtain confidential information from the victims. Attackers then use the information to steal money or to launch other attacks. An email from a trusted company such as a bank asking you to visit a link and verify your account details is an example of deceptive phishing.

When attackers go after a “big fish” like a CEO or similar, it’s called whaling. These attackers often spend a considerable amount of time profiling the target to find the opportune moment and means of obtaining their credentials. High-level executives are able to access a great deal of company information so whaling is of particular concern.

Similar to phishing, pharming sends users to a fraudulent website that appears to be legitimate. However, in this case, victims do not even have to click a malicious link to be taken to the dishonest site. Attackers can infect either the user’s computer or the website’s DNS server and redirect the user to a false website even if the correct URL is typed in.

1. Generic or informal greetings – If a message lacks personalisation (e.g. "Dear Customer") and formality then there is probably something amiss. The same applies to pseudo-personalisation using randomised, fake reference numbers 
2. A request for personal information – Frequently used by phishers, usually avoided by banks, financial institutions and most online services
3. Poor grammar – Spelling mistakes, typos and unusual phrasing often indicates a fake (but the absence of any of these is not proof of legitimacy)
4. Unexpected correspondence – Unsolicited contact from a bank or online service provider is highly unusual and thus suspicious
5. A sense of urgency – Phishing messages often try to induce rapid and less-considered action
6. An offer you cannot refuse? – If the message sounds too good to be true, it almost certainly is
7. Suspicious domain – Would a US or German bank really send an email from a Chinese domain?

1. Be aware of new phishing techniques: Follow the media for phishing attack reports, as the attackers might come up with new techniques for luring users into a trap 
2. Don’t give away your personal details: Always be alert if an electronic message from a seemingly trustworthy entity asks for your credentials or other sensitive details. If necessary, verify the contents of the message with the sender or the organisation they seemingly represent (using contact details known to be genuine rather than details provided in the message)
3. Think twice before you click: If a suspicious message provides a link or attachment, don’t click or download. Doing so might lead you to a malicious website or infect your device with malware
4. Check your online accounts regularly: Even if you don’t suspect that someone is trying to steal your credentials, check your banking and other online accounts for suspicious activity. Just in case…
5. Use a reliable anti-phishing solution. Apply these techniques and 'Enjoy Safer Technology'