What is Phishing?
Phishing is a cyber attack that uses email or other messaging apps to trick victims into downloading malware, revealing personal information or allowing attackers to steal sensitive data. Most successful attacks are carried out when the victim clicks on a malicious file attachment or a hyperlink that connects them to a fake website designed to gather valuable financial and other personal data.
The term phishing is derived from the word fish, as in “fishing for information.” The attackers attempt to lure unsuspecting victims with offers that appear too good to be true and create urgency to encourage them to act quickly. The message also might be written in a way that makes it look like the sender is familiar, such as by using casual language or by impersonating someone they know from work.
Scammers commonly impersonate organizations they think will gain their victims’ trust, including banks, online retailers and app makers. They may even use DMARC, which allows them to make an email address appear as if it is from your own domain name, to increase their chances of being believed.
Other tactics include vishing, which uses phone calls to get victims to transfer funds to the attackers. Attackers often pose as the victim’s manager, CEO or CFO over the phone using artificial intelligence voice generators and a sense of urgency to convince their target to wire money to them. This form of phishing is particularly dangerous because it can bypass many traditional security measures.