What is Phishing?
Phishing is a cyberattack that targets individuals, typically in the form of emails or text messages, to trick them into clicking on malicious links and supplying sensitive information. These phishing attacks can then be used to steal passwords, credit card numbers, bank accounts, and other personal data. The attack can be delivered over email, instant messaging apps, social media, Wi-Fi, and even over the phone (smishing or vishing).
In some cases, attackers can personalize a message to a target by using publicly available information like their name, job title, and address. This type of phishing attack is called spear phishing, and it can increase the likelihood that a victim will respond.
Cybercriminals also focus on creating a sense of urgency in their messages. This could be in the form of a fake emergency, such as “your account will be deleted” or “there is a warrant for your arrest.” A common red flag is an email that opens with a generic greeting instead of a personalized one (e.g., Dear Customer). Other warning signs include misspellings and grammatical mistakes. In addition, if an email asks you to perform a non-standard business action, such as installing software or confirming your password, it should be considered suspicious.
Organizations can mitigate phishing by providing training to employees, making it easy for staff to report suspicious emails and texts, and implementing multi-factor authentication. Individuals can reduce the risk of phishing by thinking about what personal information they post on social media, and by reviewing their privacy settings. Lastly, anyone who receives a phishing message should contact their financial institution immediately and place fraud alerts on their credit files and accounts.