Born circa 1995, just 4 years after the first site appeared, phishing refers to the practice of using deceptive emails and websites to illegally get personal and corporate information from users. That information – usernames, password, credit cards – is later used to steal either money or more information. <\/p>\n\n\n\n
The word \u201cphishing\u201d itself is a combination of \u201cfishing\u201d and \u201cphreaks\u201d which was what hackers used to call themselves. The practice of phishing is considered a form of social engineering, which is a term for manipulating people by falsely representing oneself in the context of web security. <\/p>\n\n\n\n
<\/span>Types of phishing techniques<\/span><\/h2>\n\n\n\nSpear phishing<\/h3>\n\n\n\n
What is spear phishing? Spear phishing targets a specific person or organization rather than random users. This scam usually intends to steal sensitive data or information from the specific victim, such as account passwords or financial information for malicious purposes. It requires specific knowledge about the victim such as some personal details. The cybercriminals use this information, usually in an email, to pretend they\u2019re a trustworthy organization or person and acquire the data they need.<\/p>\n\n\n\n
Spear phishing vs phishing<\/h4>\n\n\n\n
Both of them are online attacks that intend to steal sensitive information. However, phishing is the more general term for this type of attack, as this is basically any attempt to trick victims to share sensitive data. <\/p>\n\n\n\n
As per the spear phishing definition, it is personalized to the specific victim. It requires more thought, time and knowledge to achieve its goal. Since spear phishing\u2019s messages are personalized, it\u2019s more difficult to identify these types of attacks.<\/p>\n\n\n\n
What helps protect from spear phishing is generally being careful with your online presence. Here are a few tips to follow in order to avoid spear phishing:<\/p>\n\n\n\n
\n- Be careful what personal information you post on the internet<\/li>\n\n\n\n
- Use smart and strong passwords<\/li>\n\n\n\n
- Update your software regularly<\/li>\n\n\n\n
- Watch out when opening emails and clicking on links<\/li>\n<\/ul>\n\n\n\n
Microsoft 365 phishing<\/h3>\n\n\n\n
These types of attacks are phishing emails that target Microsoft 365 users. One of the most common things that attackers usually do is tricking victims into downloading a file by disguising its extension. Attackers use a special Unicode character, the right-to-left override. It allows them, for example, to disguise an \u201c.exe\u201d file as a \u201c.txt\u201d file. As a result, the victim downloads the \u201c.exe\u201d file which installs malicious software on their computer or laptop.<\/p>\n\n\n\n
Whaling phishing<\/h3>\n\n\n\n
Whaling phishing is a highly targeted attack. This type of phishing attack targets particular individuals, such as senior executives, and disguises as a legitimate email. It attempts to encourage victims to do a particular action, usually related to transferring money or giving out specific information. Whaling phishing emails often target large financial institutions and are more complicated than general phishing emails because they target C-level executives.<\/p>\n\n\n\n
These emails usually contain personalized information about the organization\/C-level executive, create a sense of urgency, comply with the business tone, and they encourage you to do some of the following:<\/p>\n\n\n\n
\n- Click on a link that eventually brings malware<\/li>\n\n\n\n
- Transfer money to the attacker\u2019s bank account<\/li>\n\n\n\n
- Provide further information about the business or individual<\/li>\n<\/ul>\n\n\n\n
Voice phishing<\/h3>\n\n\n\n
Voice phishing is an attack which tricks individuals to provide important financial or personal information over the phone to third parties. You can become a victim of a voice phishing attack over various channels and devices, such as voice email, smartphone, landline phone, voice over IP, etc.<\/p>\n\n\n\n
The message of such an attack usually informs the victim of a suspicious activity, related to their bank account\/credit or debit card, etc. Then the attacker encourages the victim to call a phone number and provide more personal information or verify their account\/identity. <\/p>\n\n\n\n
To protect yourself from such an attack, the best approach is to call the given institution via a valid contact channel you have and make sure that your account has not been compromised.<\/p>\n\n\n\n
Business email compromise (BEC)<\/h3>\n\n\n\n
Business email compromise is an email message that appears legitimate, requests a particular action, and targets a specific company. The request in the message is usually about transferring funds to the attacker\u2019s bank account that:<\/p>\n\n\n\n
\n- Pretends to be the \u201cregular supplier\u201d that has sent an invoice from an updated mailing address<\/li>\n\n\n\n
- Pretends to be the CEO of the company<\/li>\n\n\n\n
- Pretends to be an employee of the company and has hacked their email address<\/li>\n\n\n\n
- Pretends to be the lawyer of the company<\/li>\n<\/ul>\n\n\n\n
Social media phishing<\/h3>\n\n\n\n
Social media phishing is related to attacks via social media such as Facebook, Instagram, Twitter, LinkedIn, etc. It aims at stealing your personal information or taking over your social media account. Such an attack can also result in financial loss due to getting data for access to financial accounts. To protect yourself from a social media phishing attack, follow these simple rules:<\/p>\n\n\n\n
\n- Don\u2019t add\/accept strangers as friends<\/li>\n\n\n\n
- Don\u2019t click on links to update your personal information<\/li>\n\n\n\n
- Don\u2019t use the same username and password for all your accounts<\/li>\n\n\n\n
- Use the latest version of your operating system<\/li>\n<\/ul>\n\n\n\n
<\/span>How Can You Prevent Phishing?<\/span><\/h2>\n\n\n\nBecause phishing can truly cost you a lot – from stolen money to huge data breaches in your company – taking proper safety precautions is a must. We\u2019ve put together a shortlist of the things you need to keep in mind in order to stay safe online.<\/p>\n\n\n\n
1. Pay Attention To The Sender and The URL in Your Emails<\/h3>\n\n\n\n
One of the most common phishing scams is to spoof a big brand by sending an email with their name (and usually color palette), and say there is something wrong with your account and ask you to log in \u201cto fix it\u201d. Usually, the look of the email is very similar to the original brand, however, there is a sure way to distinguish whether you\u2019re looking at the real deal. <\/p>\n\n\n\n
A good way to identify phishing emails is to check the email address: scammers cannot create email addresses with the actual domain name of the company, so instead of help@bigbrandname.com<\/a> it will usually look like bigbrandname@somethingelse.com<\/a>. Look carefully at the email address and not just the name appearing in your email client!<\/p>\n\n\n\n![\"Check](\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2022\/10\/Phishing_Image2_1480x740-1024x512.png\")
<\/a><\/figure>\n\n\n\nYou should also check the URL before clicking. This can be done by hovering the mouse over the URL provided in the email, it will usually reveal the domain it\u2019s pointing at, so you can see where this email actually wants to take you. If it\u2019s not the official domain of the brand, don\u2019t click on it.<\/p>\n\n\n\n
2. Avoid Downloading Email Attachments You Don\u2019t Expect<\/h3>\n\n\n\n
Sometimes the email looks like legitime business emails, and they don\u2019t pretend to be a big company, but instead send over an attachment containing some sort of malware. The email is often structured as a business offer or \u0430n email sent by the recipient\u2019s own company\/management containing files with sensitive information.<\/p>\n\n\n\n
If you don\u2019t know who the sender is, definitely don\u2019t open any attachments. If you know the sender, but you don\u2019t expect anything from them, or there is something fishy about it, it\u2019s better to be cautious. Call the sender and ask them if they meant to send you anything, as sometimes scammers hack into people\u2019s email boxes and use them for phishing attacks by spamming their contacts.<\/p>\n\n\n\n![\"Be](\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2022\/10\/Phishing_Image1_1480x740-1-1024x513.png\")
<\/a><\/figure>\n\n\n\nThe most common format for the attachments is zip (.exe is usually not allowed), however, even Microsoft Office files can contain viruses, which can contain macros that need to be enabled. Overall, keep an eye for all kinds of attachments. <\/p>\n\n\n\n
3. Always Check The Site You\u2019ve Landed On<\/h3>\n\n\n\n
If you happen to click on a phishing link (usually via email or through instant messages), it will often take you to a website with a form of some sort. The purpose of these forms most often aim to gather your most sensitive information – usernames and passwords. <\/p>\n\n\n\n
In order to be sure you’re at the correct site and before filling in any data, check the website address in the browser address bar. <\/p>\n\n\n\n
Scammers can create a website closely resembling the design of the respective brand, but they can\u2019t use their official domain or have the brand name in the domain (assuming the brand is trademark protected). So, often, these domains may resemble a brand\u2019s name, but will never be the original one, and will have additional symbols, letters, or words. <\/p>\n\n\n\n
Usually, the scammy domains look completely nonsensical and sometimes the design and flow also feels odd, especially if it\u2019s a known brand that you often see. <\/p>\n\n\n\n
For example, when signing into Gmail, Google will never ask you to select your email provider or enter both your email and password on the same screen. So the flow you will often see on phishing sites is designed to resemble the original one, but it\u2019s not. <\/p>\n\n\n\n![\"Always](\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2022\/10\/Phishing_Image3_1480x740-1-1024x512.png\")
<\/a><\/figure>\n\n\n\n4. Ignore Money Requests<\/h3>\n\n\n\n
Another type of online scam that social engineers often use is misrepresenting themselves and asking for money under some form. An example of such phishing emails is a person in trouble, asking for financial help; you’re asked to send a small amount of money with the promise you\u2019ll get way more in return. <\/p>\n\n\n\n
Sometimes these scams can take the form of extortion. A popular one was an email circulating in the past couple of years, stating that users have been recorded through their own webcams watching adult content and asking for money. Actually, this scam attack was so scary, it made the news as people were terrified – understandably so! <\/p>\n\n\n\n
Either way, if you are getting a money request under any form by strangers, it\u2019s usually a scam; never give out money or financial information no matter how the situation is presented.<\/p>\n\n\n\n
<\/span>What should you do if you receive a phishing email?<\/span><\/h2>\n\n\n\nEvery time you receive an email, you need to be extra careful of the email address, the URL, their spelling, etc. After checking these and identifying that the email is actually a phishing email, you need to follow all of the steps below:<\/p>\n\n\n\n
\n- Don\u2019t click on any links & don\u2019t open any attachments & don\u2019t reply;<\/li>\n\n\n\n
- Contact the alleged sender via official channel for communication;<\/li>\n\n\n\n
- Report the email to your company & email provider & government body & the organization that allegedly sent the email;<\/li>\n\n\n\n
- Mark the sender as junk or spam;<\/li>\n\n\n\n
- Delete the email & remove from recycle bin\/deleted items folder.<\/li>\n<\/ol>\n\n\n\n
<\/span>How to report phishing emails?<\/span><\/h2>\n\n\n\nAs previously mentioned, you need to report the phishing email to several people\/institutions. Here we\u2019ll show you how to report the email both to the email provider and to the government body.<\/p>\n\n\n\n
How to report phishing emails to your email provider <\/h3>\n\n\n\n
Let\u2019s take as an example, Gmail accounts. Next to the \u201cReply\u201d option in Gmail, click the \u201cMore\u201d option and select \u201cReport phishing\u201d.<\/p>\n\n\n\n
If you are an Outlook user, you need to select the phishing email message from the message list and above the reading pane, select Junk > Phishing > Report.<\/p>\n\n\n\n
Other email providers have similar easy to use options for reporting phishing emails.<\/p>\n\n\n\n
How to report to a specific institution, based on the country you\u2019re in<\/h3>\n\n\n\n
The Anti-Phishing Working Group (APWG) is an international coalition that attempts to eliminate cybercrime. If you receive a suspicious or malicious email, forward it to this organisation at reportphishing@apwg.org<\/a>.<\/a> <\/span>Below you can see some other country-specific institutions that can help you too:<\/p>\n\n\n\n\n- For the USA, forward phishing emails to the National Cybersecurity Communications and Integration Center (NCCIC) at phishing-report@us-cert.gov<\/a>.<\/li>\n\n\n\n
- For the UK, report the phishing email to Action Fraud<\/a>, the UK\u2019s fraud and cyber crime reporting center.<\/li>\n\n\n\n
- If you\u2019re living in a European Union country, here<\/a>\u00a0you can find the reporting website, corresponding to your country, in case you are a victim of a cybercrime.<\/li>\n<\/ul>\n\n\n\n
<\/span>Final thoughts<\/span><\/h2>\n\n\n\n
Microsoft 365 phishing<\/h3>\n\n\n\n
These types of attacks are phishing emails that target Microsoft 365 users. One of the most common things that attackers usually do is tricking victims into downloading a file by disguising its extension. Attackers use a special Unicode character, the right-to-left override. It allows them, for example, to disguise an \u201c.exe\u201d file as a \u201c.txt\u201d file. As a result, the victim downloads the \u201c.exe\u201d file which installs malicious software on their computer or laptop.<\/p>\n\n\n\n
Whaling phishing<\/h3>\n\n\n\n
Whaling phishing is a highly targeted attack. This type of phishing attack targets particular individuals, such as senior executives, and disguises as a legitimate email. It attempts to encourage victims to do a particular action, usually related to transferring money or giving out specific information. Whaling phishing emails often target large financial institutions and are more complicated than general phishing emails because they target C-level executives.<\/p>\n\n\n\n
These emails usually contain personalized information about the organization\/C-level executive, create a sense of urgency, comply with the business tone, and they encourage you to do some of the following:<\/p>\n\n\n\n
- \n
- Click on a link that eventually brings malware<\/li>\n\n\n\n
- Transfer money to the attacker\u2019s bank account<\/li>\n\n\n\n
- Provide further information about the business or individual<\/li>\n<\/ul>\n\n\n\n
Voice phishing<\/h3>\n\n\n\n
Voice phishing is an attack which tricks individuals to provide important financial or personal information over the phone to third parties. You can become a victim of a voice phishing attack over various channels and devices, such as voice email, smartphone, landline phone, voice over IP, etc.<\/p>\n\n\n\n
The message of such an attack usually informs the victim of a suspicious activity, related to their bank account\/credit or debit card, etc. Then the attacker encourages the victim to call a phone number and provide more personal information or verify their account\/identity. <\/p>\n\n\n\n
To protect yourself from such an attack, the best approach is to call the given institution via a valid contact channel you have and make sure that your account has not been compromised.<\/p>\n\n\n\n
Business email compromise (BEC)<\/h3>\n\n\n\n
Business email compromise is an email message that appears legitimate, requests a particular action, and targets a specific company. The request in the message is usually about transferring funds to the attacker\u2019s bank account that:<\/p>\n\n\n\n
- \n
- Pretends to be the \u201cregular supplier\u201d that has sent an invoice from an updated mailing address<\/li>\n\n\n\n
- Pretends to be the CEO of the company<\/li>\n\n\n\n
- Pretends to be an employee of the company and has hacked their email address<\/li>\n\n\n\n
- Pretends to be the lawyer of the company<\/li>\n<\/ul>\n\n\n\n
Social media phishing<\/h3>\n\n\n\n
Social media phishing is related to attacks via social media such as Facebook, Instagram, Twitter, LinkedIn, etc. It aims at stealing your personal information or taking over your social media account. Such an attack can also result in financial loss due to getting data for access to financial accounts. To protect yourself from a social media phishing attack, follow these simple rules:<\/p>\n\n\n\n
- \n
- Don\u2019t add\/accept strangers as friends<\/li>\n\n\n\n
- Don\u2019t click on links to update your personal information<\/li>\n\n\n\n
- Don\u2019t use the same username and password for all your accounts<\/li>\n\n\n\n
- Use the latest version of your operating system<\/li>\n<\/ul>\n\n\n\n
<\/span>How Can You Prevent Phishing?<\/span><\/h2>\n\n\n\n
Because phishing can truly cost you a lot – from stolen money to huge data breaches in your company – taking proper safety precautions is a must. We\u2019ve put together a shortlist of the things you need to keep in mind in order to stay safe online.<\/p>\n\n\n\n
1. Pay Attention To The Sender and The URL in Your Emails<\/h3>\n\n\n\n
One of the most common phishing scams is to spoof a big brand by sending an email with their name (and usually color palette), and say there is something wrong with your account and ask you to log in \u201cto fix it\u201d. Usually, the look of the email is very similar to the original brand, however, there is a sure way to distinguish whether you\u2019re looking at the real deal. <\/p>\n\n\n\n
A good way to identify phishing emails is to check the email address: scammers cannot create email addresses with the actual domain name of the company, so instead of help@bigbrandname.com<\/a> it will usually look like bigbrandname@somethingelse.com<\/a>. Look carefully at the email address and not just the name appearing in your email client!<\/p>\n\n\n\n
<\/a><\/figure>\n\n\n\nYou should also check the URL before clicking. This can be done by hovering the mouse over the URL provided in the email, it will usually reveal the domain it\u2019s pointing at, so you can see where this email actually wants to take you. If it\u2019s not the official domain of the brand, don\u2019t click on it.<\/p>\n\n\n\n
2. Avoid Downloading Email Attachments You Don\u2019t Expect<\/h3>\n\n\n\n
Sometimes the email looks like legitime business emails, and they don\u2019t pretend to be a big company, but instead send over an attachment containing some sort of malware. The email is often structured as a business offer or \u0430n email sent by the recipient\u2019s own company\/management containing files with sensitive information.<\/p>\n\n\n\n
If you don\u2019t know who the sender is, definitely don\u2019t open any attachments. If you know the sender, but you don\u2019t expect anything from them, or there is something fishy about it, it\u2019s better to be cautious. Call the sender and ask them if they meant to send you anything, as sometimes scammers hack into people\u2019s email boxes and use them for phishing attacks by spamming their contacts.<\/p>\n\n\n\n
<\/a><\/figure>\n\n\n\nThe most common format for the attachments is zip (.exe is usually not allowed), however, even Microsoft Office files can contain viruses, which can contain macros that need to be enabled. Overall, keep an eye for all kinds of attachments. <\/p>\n\n\n\n
3. Always Check The Site You\u2019ve Landed On<\/h3>\n\n\n\n
If you happen to click on a phishing link (usually via email or through instant messages), it will often take you to a website with a form of some sort. The purpose of these forms most often aim to gather your most sensitive information – usernames and passwords. <\/p>\n\n\n\n
In order to be sure you’re at the correct site and before filling in any data, check the website address in the browser address bar. <\/p>\n\n\n\n
Scammers can create a website closely resembling the design of the respective brand, but they can\u2019t use their official domain or have the brand name in the domain (assuming the brand is trademark protected). So, often, these domains may resemble a brand\u2019s name, but will never be the original one, and will have additional symbols, letters, or words. <\/p>\n\n\n\n
Usually, the scammy domains look completely nonsensical and sometimes the design and flow also feels odd, especially if it\u2019s a known brand that you often see. <\/p>\n\n\n\n
For example, when signing into Gmail, Google will never ask you to select your email provider or enter both your email and password on the same screen. So the flow you will often see on phishing sites is designed to resemble the original one, but it\u2019s not. <\/p>\n\n\n\n
<\/a><\/figure>\n\n\n\n4. Ignore Money Requests<\/h3>\n\n\n\n
Another type of online scam that social engineers often use is misrepresenting themselves and asking for money under some form. An example of such phishing emails is a person in trouble, asking for financial help; you’re asked to send a small amount of money with the promise you\u2019ll get way more in return. <\/p>\n\n\n\n
Sometimes these scams can take the form of extortion. A popular one was an email circulating in the past couple of years, stating that users have been recorded through their own webcams watching adult content and asking for money. Actually, this scam attack was so scary, it made the news as people were terrified – understandably so! <\/p>\n\n\n\n
Either way, if you are getting a money request under any form by strangers, it\u2019s usually a scam; never give out money or financial information no matter how the situation is presented.<\/p>\n\n\n\n
<\/span>What should you do if you receive a phishing email?<\/span><\/h2>\n\n\n\n
Every time you receive an email, you need to be extra careful of the email address, the URL, their spelling, etc. After checking these and identifying that the email is actually a phishing email, you need to follow all of the steps below:<\/p>\n\n\n\n
- \n
- Don\u2019t click on any links & don\u2019t open any attachments & don\u2019t reply;<\/li>\n\n\n\n
- Contact the alleged sender via official channel for communication;<\/li>\n\n\n\n
- Report the email to your company & email provider & government body & the organization that allegedly sent the email;<\/li>\n\n\n\n
- Mark the sender as junk or spam;<\/li>\n\n\n\n
- Delete the email & remove from recycle bin\/deleted items folder.<\/li>\n<\/ol>\n\n\n\n
<\/span>How to report phishing emails?<\/span><\/h2>\n\n\n\n
As previously mentioned, you need to report the phishing email to several people\/institutions. Here we\u2019ll show you how to report the email both to the email provider and to the government body.<\/p>\n\n\n\n
How to report phishing emails to your email provider <\/h3>\n\n\n\n
Let\u2019s take as an example, Gmail accounts. Next to the \u201cReply\u201d option in Gmail, click the \u201cMore\u201d option and select \u201cReport phishing\u201d.<\/p>\n\n\n\n
If you are an Outlook user, you need to select the phishing email message from the message list and above the reading pane, select Junk > Phishing > Report.<\/p>\n\n\n\n
Other email providers have similar easy to use options for reporting phishing emails.<\/p>\n\n\n\n
How to report to a specific institution, based on the country you\u2019re in<\/h3>\n\n\n\n
The Anti-Phishing Working Group (APWG) is an international coalition that attempts to eliminate cybercrime. If you receive a suspicious or malicious email, forward it to this organisation at reportphishing@apwg.org<\/a>.<\/a> <\/span>Below you can see some other country-specific institutions that can help you too:<\/p>\n\n\n\n
- \n
- For the USA, forward phishing emails to the National Cybersecurity Communications and Integration Center (NCCIC) at phishing-report@us-cert.gov<\/a>.<\/li>\n\n\n\n
- For the UK, report the phishing email to Action Fraud<\/a>, the UK\u2019s fraud and cyber crime reporting center.<\/li>\n\n\n\n
- If you\u2019re living in a European Union country, here<\/a>\u00a0you can find the reporting website, corresponding to your country, in case you are a victim of a cybercrime.<\/li>\n<\/ul>\n\n\n\n
<\/span>Final thoughts<\/span><\/h2>\n\n\n\n
- For the UK, report the phishing email to Action Fraud<\/a>, the UK\u2019s fraud and cyber crime reporting center.<\/li>\n\n\n\n
- For the USA, forward phishing emails to the National Cybersecurity Communications and Integration Center (NCCIC) at phishing-report@us-cert.gov<\/a>.<\/li>\n\n\n\n