What is phishing? Everything you need to know to protect yourself from scam emails and more

Danny Palmer is a senior reporter at ZDNet. Based in London, he writes about issues including cybersecurity, hacking and malware threats.

What is phishing?

Phishing is one of the easiest forms of cyberattack for criminals to carry out, and one of the easiest to fall for. It's also one that can provide everything hackers need to ransack their targets' personal and work accounts.

Usually carried out over email - although the scam has now spread beyond suspicious emails to phone calls (so-called 'vishing') social media, messaging services (aka 'smishing') and apps - a basic phishing attack attempts to trick the target into doing what the scammer wants.

Privacy

That might be handing over passwords to make it easier to hack a company, or altering bank details so that payments go to fraudsters instead of the correct account.

SEE: Network security policy (TechRepublic Premium)

Phishing is also a popular method for cyber attackers to deliver malware, by encouraging victims to download a document or visit a link that will secretly install the malicious payload in attacks that could be distributing trojan malware, ransomware or all manner of damaging and disruptive attacks.

The aim and the precise mechanics of the scams vary: for example, victims might be tricked into clicking a link through to a fake web page with the aim of persuading the user to enter personal information - it's estimated that an average of 1.4 million of these websites are created every month.

More complex phishing schemes can involve a long game, with hackers using fake social media profiles, emails and more to build up a rapport with the victim over months or even years in cases where specific individuals are targeted for data that they would only ever hand over to people they trust.

That data can range from personal or corporate email address and password, to financial data such as credit card details or online banking credentials or even personal data such as date of birth, address and a social security number.

In the hands of fraudsters, all of that information can be used to carry out scams like identity theft or using stolen data to buy things or even selling people's private information on the dark web. In some cases, it's done for blackmail or to embarrass the victim.

In other cases, phishing is one of the tools used for espionage or by state-backed hacking groups to spy on opponents and organisations of interest.

And anyone can be a victim, ranging from the Democratic National Committee in the run up to 2016 US Presidential Election, to critical infrastructure, to commercial businesses and even individuals.

Whatever the ultimate goal of the attack, phishing revolves around scammers tricking users into giving up data or access to systems in the mistaken belief they are dealing with someone they know or trust.

How does a phishing attack work?

A basic phishing attack attempts to trick a user into entering personal details or other confidential information, and email is the most common method of performing these attacks.

The sheer number of emails sent every single day means that it's an obvious attack vector for cyber criminals. It's estimated that 3.7 billion people send around 269 billion emails every single day.

Researchers at Symantec suggest that almost one in every 2,000 of these emails is a phishing email, meaning around 135 million phishing attacks are attempted every day.

SEE: My stolen credit card details were used 4,500 miles away. I tried to find out how it happened

Most people simply don't have the time to carefully analyse every message that lands in their inbox - and it's this that phishers look to exploit in a number of ways.

Scams vary in their targets - some are aiming at unwary consumers. Here, their email subject line will be designed to catch the victim's eye - common phishing campaign techniques include offers of prizes won in fake competitions such as lotteries or contests by retailers offering a 'winning voucher'.

In this example, in order to 'win' the prize, the victims are asked to enter their details such as name, date of birth, address and bank details in order to claim. Obviously, there's no prize and all they've done is put their personal details into the hands of hackers.

Similar techniques are used in other scams in which attackers claim to be from a bank or other financial institution looking to verify details, online shops attempting to verify non-existent purchases or sometimes -- even more cheekily-- attackers will claim to be from tech security companies and that they need access to information in order to keep their customers safe.

Other scams, usually more sophisticated, aim at business users. Here attackers might also pose as someone from within the same organisation or one of its suppliers and will ask you to download an attachment that they claim contains information about a contract or deal.

In some cases the aim may be to harvest personal data, but in many cases it's also used to deploy ransomware or rope systems into a botnet.

Attackers will often use high-profile events as a lure in order to reach their end goals. For example, 2020 has seen cyber criminals extensively send emails that supposedly contain information about coronavirus as a means of luring people into falling victim. Cyber criminals have also attempted to use the 2020 US Presidential election as a means of attack.

One common technique is to deliver a Microsoft Office document that requires the user to enable macros to run. The message that comes with the document aims to trick the potential victim into enabling macros to allow the document to be viewed properly, but in this case it will allow the crooks to deliver their malware payload.

Why is phishing called phishing?

The overall term for these scams -- phishing -- is a modified version of 'fishing' except in this instance the one doing this fishing is the crook, and they're trying to catch you and reel you in with their sneaky email lure.

It's also likely a reference to hacker history: some of the earliest hackers were known as 'phreaks' or 'phreakers' because they reverse engineered phones to make free calls.

When did phishing begin?

The consensus is that the first example of the word phishing occurred in the mid-1990s with the use of software tools like AOHell that attempted to steal AOL user names and passwords.

These early attacks were successful because it was a new type of attack, something users hadn't seen before. AOL provided warnings to users about the risks, but phishing remained successful and it's still here over 20 years on. In many ways, it has remained very much the same for one simple reason - because it works.

How did phishing evolve?

While the fundamental concept of phishing hasn't changed much, there have been tweaks and experimentation across two decades as technology and how we access the internet has changed. Following the initial AOL attacks, email became the most appealing attack vector for phishing scams as home internet use took off and a personal email address started to become more common.

Many early phishing scams came with tell-tale signs that they weren't legitimate - including strange spelling, weird formatting, low-res images and messages that often didn't make complete sense. Nonetheless, in the early days of the internet, people knew even less about potential threats that meant these attacks still found success - many of these are still effective.

Some phishing campaigns remain really, really obvious to spot - like the prince who wants to leave his fortune to you, his one long-lost relative, but others have become to be so advanced that it's virtually impossible to tell them apart from authentic messages. Some might even look like they come from your friends, family, colleagues or even your boss.

What's the cost of phishing attacks?

It's hard to put a total cost on the fraud that flows from phishing scams, but the FBI suggests that the impact of such scams could be costing US business somewhere around $5bn a year, with thousands of companies hit by scams annually.

One example of a high-profile incident: in July 2017, MacEwan University in Edmonton, Alberta, Canada fell victim to a phishing attack.

"A series of fraudulent emails convinced university staff to change electronic banking information for one of the university's major vendors. The fraud resulted in the transfer of $11.8 million to a bank account that staff believed belonged to the vendor," the university said in a statement.

What do phishing scams look like?

The 'spray and pray' is the least sophisticated type of phishing attack, whereby basic, generic messages are mass-mailed to millions of users. These are the 'URGENT message from your bank' and 'You've won the lottery' messages that look to panic victims into making an error -- or blind them with greed. Some emails attempt to use fear, suggesting there's a warrant out for the victim's arrest and they'll be thrown in jail if they don't click through.

Schemes of this sort are so basic that there's often not even a fake web page involved - victims are often just told to respond to the attacker via email. Sometimes emails might play on the pure curiosity of the victim, simply appearing as a blank message with a malicious attachment to download.

This is the way Locky ransomware spread in 2016 and at the time it was one of the the most effective forms of the file-encrypting malware around. Many of the most damaging ransomware campaigns have now switched to other means of gaining access to networks, such as compromising internet-facing servers or remote desktop ports, although there's recently been a resurgence in phishing emails being used to distribute ransomware.

These attacks are mostly ineffective, but the sheer number of messages being sent out means that there will be people who fall for the scam and inadvertently send details to cyber attackers who'll exploit the information in any way they can.

What is spear phishing?

Spear phishing is more advanced than a regular phishing message and aims at specific groups or even particular individuals. Instead of vague messages being sent, criminals design them to target anything from a specific organisation, to a department within that organisation or even an individual in order to ensure the greatest chance that the email is read and the scam is a success.

It's these sorts of specially crafted messages that have often been the entry point for a number of high-profile cyberattacks and hacking incidents. Both cyber-criminal gangs and nation-state-backed attackers continue to use this as means of beginning espionage campaigns.

SEE: VPN: Picking a provider and troubleshooting tips (free PDF) (TechRepublic)

At a consumer level, it can be designed to look like an update from your bank, it could say you've ordered something online, it could relate to any one of your online accounts. Hackers have even been known to seek out victims of data breaches and pose as security professionals warning victims of compromise - and that targets should ensure their account is still secure by entering their account details into this handy link.

While spear phishing does target consumers and individual internet users, it's much more effective for cyber criminals to use it as a means of infiltrating the network of a target organisation as it can produce a far more lucrative bounty.

This particular type of phishing message can come in a number of forms including a false customer query, a false invoice from a contractor or partner company, a false request to look at a document from a colleague, or even in some cases, a message that looks as if it comes directly from the CEO or another executive.

Rather than being a random message, the idea is to make it look as if it has come from a trusted source, and coax the target into either installing malware or handing over confidential credentials or information. These scams take more effort but there's a bigger potential payback for crooks, too.

It's quite possible for hackers to compromise the account of one user and use that as a stepping stone for further attacks. These 'conversation hijacking' attacks take advantage of using a real person's account to send additional phishing emails to their real contacts - and because the email comes from a trusted source, the intended victim is more likely to click.

What is Business Email Compromise?

Recent years have seen the rise of a supremely successful form of targeted phishing attack that sees hackers pose as legitimate sources – such as management, a colleague or a supplier – and trick victims into sending large financial transfers into their accounts. This is often known as Business Email Compromise (BEC).

According to the FBI, common BEC scams include: cyber criminals posing as a vendor your company regularly deals with that sends an invoice with a (fake) updated mailing address; a company CEO asking an employee to buy gift cards to send out as rewards – and to be sent the gift card codes over immediately; or a homebuyer receiving an email about transferring a down-payment.

SEE: FBI: BEC scams accounted for half of the cyber-crime losses in 2019

In each instance, the attacker will rely heavily on social engineering, often attempting to generate a sense of urgency that the money transfer needs to be made right now, and in secret.

For example, attackers have been known to compromise the email account for a supplier that they'll use to send an 'urgent' invoice that needs paying to the victim.

Cyber criminals also engage in CEO Fraud, a subset of BEC attack, where the attackers pose as a board member or manager, asking an employee to transfer funds to a specific account – often claiming it as a matter of secrecy and urgency.

In each of these cases, the attackers direct the funds into bank accounts they control, then make off with the money.

It's estimated that BEC attacks were responsible for half the money lost to cyber criminals during 2019, and almost $700m is being lost to these attacks every month.

The growth of remote working during 2020 has arguably made it easier for criminals to conduct these schemes, because people working from home can't as easily talk to one of their colleagues to check if the email is legitimate.

What types of phishing attacks are there?

While email still remains a large focus of attackers carrying out phishing campaigns, the world is very different to how it was when phishing first started. No longer is email the only means of targeting a victim as the rise of mobile devices, social media and more have provided attackers with a wider variety of vectors to use for attacking victims.

What is social media phishing?

With billions of people around the world using social media services such as Facebook, LinkedIn and Twitter, attackers are no longer restricted to use one means of sending messages to potential victims.

Some attacks are simple and easy to spot: a Twitter bot might send you a private message containing a shortened URL that leads to something bad such as malware or maybe even a fake request for payment details.

SEE: Mobile security: These seven malicious apps have been downloaded by 2.4m Android and iPhone users

But there are other attacks that play a longer game. A common tactic used by phishers is to pose as a person using photos ripped from the internet, stock imagery or someone's public profile. Often these are just harvesting Facebook 'friends' for some future mission and don't actually interact with the target.

However, sometimes plain old catfishing comes into play, with the attacker establishing a dialogue with the (often male) target - all while posing as a fake persona.

After a certain amount of time - it could be days, it could be months - the attacker might concoct a false story and ask the victim for details of some kind such as bank details, information, even login credentials, before disappearing into the ether with their info.

One campaign of this nature targeted individuals in organisations in the financial, oil and technology sectors with advanced social engineering based around a single, prolific social media persona that was absolutely fake.

Those behind 'Mia Ash' are thought to have been working on behalf of the Iranian government and tricked victims into handing over login credentials and private documents.

What is SMS and mobile phishing?

The rise of mobile messaging services - Facebook Messenger and WhatsApp in particular - has provided phishers with a new method of attack.

Attackers don't even need to use emails or instant messaging apps in order to meet the end goal of distributing malware or stealing credentials - the internet-connected nature of modern communications means text messages are also an effective attack vector.

SMS phishing - or smishing - attacks work in much the same way as an email attack; presenting the victim with a fraudulent offer or fake warning as an incentive to click through to a malicious URL.

The nature of text messaging means the smishing message is short and designed to grab the attention of the victim, often with the aim of panicking them into clicking on the phishing URL. A common attack by smishers is to pose as a bank and fraudulently warn that the victim's account has been closed, had cash withdrawn or is otherwise compromised.

The truncated nature of the message often doesn't provide the victim with enough information to analyse whether the message is fraudulent, especially when text messages don't contain tell-tale signs such as a sender address.

Once the victim has clicked on the link, the attack works in the same way as a regular phishing attack, with the victim duped into handing over their information and credentials to the perpetrator.

What is cryptocurrency phishing?

As the popularity - and value -of cryptocurrencies like Bitcoin, Monero and others have grown, attackers want a piece of the pie. Some hackers use cryptojacking malware, which secretly harnesses the power of a compromised machine to mine for cryptocurrency.

However, unless the attacker has a large network of PCs, servers or IoT devices doing their bidding, making money from this kind of campaign can be an arduous task that involves waiting months. Another option for crooks is to use phishing to steal cryptocurrency directly from the wallets of legitimate owners.

In a prominent example of cryptocurrency phishing, one criminal group conducted a campaign that copied the front of Ethereum wallet website MyEtherWallet and encouraged users to enter their login details and private key.

Once this information has been gathered, an automatic script automatically created the fund transfer by pressing the buttons like a legitimate user would, but all while the activity remained hidden from the user until it was too late. The theft of cryptocurrency in phishing campaigns like this and other attacks is costing millions.

How can I spot a phishing attack?

At the core of phishing attacks, regardless of the technology or the particular target, is deception.

While many in the information security sector might raise an eyebrow when it comes to the lack of sophistication of some phishing campaigns, it's easy to forget that there are billions of internet users - and everyday there are people who are only accessing the internet for the first time.

SEE: Personally identifiable information (PII): What it is, how it's used, and how to protect it

Large swathes of internet users therefore won't even be aware about the potential threat of phishing, let alone that they might be targeted by attackers using it. Why would they even suspect that the message in their inbox isn't actually from the organisation or friend it claims to be from?

But while some phishing campaigns are so sophisticated and specially crafted that the message looks totally authentic, there are some key give-aways in less advanced campaigns that can make it obvious to spot an attempted attack.

Signs of phishing: Poor spelling and grammar

Many of the less professional phishing operators still make basic errors in their messages - notably when it comes to spelling and grammar.

Official messages from any major organisation are unlikely to contain bad spelling or grammar, and certainly not repeated instances throughout the body. A poorly written message should act as an immediate warning that the communication might not be legitimate.

It's common for attackers to use a service like Google Translate to translate the text from their own first language, but despite the popularity of these services, they still struggle to make messages sound natural.

How to spot a phishing link

It's very common for email phishing messages to coerce the victim into clicking through a link to a malicious or fake website designed for malicious purposes.

Many phishing attacks will contain what looks like an official-looking URL. However, it's worth taking a second careful look.

In some instances, it can simply be a shortened URL, whereby the attackers hope the victim won't check the link and will just click through. In other instances, attackers will take a minor variation on a legitimate web address and hope the user doesn't notice.

Ultimately, if you are suspicious of a URL in an email, hover over it to examine the landing page address and, if it looks fake, don't click on it. And check that it is the correct URL and not one that looks very similar but slightly different to one that that you'd usually expect.

A strange or mismatched sender address

You receive a message that looks to be from an official company account. The message warns you that there's been some strange activity using your account and urges you to click the link provided to verify your login details and the actions that have taken place.

The message looks legitimate, with good spelling and grammar, the correct formatting and the right company logo, address and even contact email address in the body of the message. But what about the sender address?

SEE: Security Awareness and Training policy (TechRepublic Premium)

In many instances, the phisher can't fake a real address and just hopes that readers don't check. Often the sender address will just be listed as a string of characters rather than as sent from an official source.

Another trick is to make the sender address almost look exactly like the company - for example, one campaign claiming to be from 'Microsoft's Security Team' urged customers to reply with personal details to ensure they weren't hacked. However, there isn't a division of Microsoft with that name - and it probably wouldn't be based in Uzbekistan, where the email was sent from.

Keep an eye on the sender address to ensure that the message is legitimately from who it says it is.

This phishing message looks strange and too good to be true

Congratulations! You've just won the lottery/free airline tickets/a voucher to spend in our store - now just provide us with all of your personal information including your bank details to claim the prize. As is the case with many things in life, if it seems too good to be true, it probably is.

In many cases, phishing emails with the aim of distributing malware will be sent in a blank message containing an attachment - never clicking on mysterious, unsolicited attachments is a very good tactic when it comes to not falling victim.

Even if the message is more detailed and looks as if it came from someone within your organisation, if you think the message might not be legitimate, contact someone else in the company - over the phone or in person rather than over email if necessary - to ensure that they really did send it.

How to protect against phishing attacks

Training, training and more training. It might seem like a simple idea, but training is effective. Teaching staff what to look out for when it comes to a phishing email can go a long way to protecting your organisation from malicious attacks.

Exercises allow staff to make errors - and crucially learn from them - in a protected environment. At a technical level, disabling macros from being run on computers in your network can play a big part in protecting employees from attacks. Macros aren't designed to be malicious - they're designed to help users perform repetitive tasks with keyboard shortcuts.

However, the same processes can be exploited by attackers in order to help them execute malicious code and drop malware payloads.

Most newer versions of Office automatically disable macros, but it's worth checking to ensure that this is the case for all the computers on your network - it can act as a major barrier to phishing emails attempting to deliver a malicious payload.

Multi-factor authentication also provides a strong barrier against phishing attacks because it requires an extra step for cyber criminals to overcome in order to conduct a successful attack. According to Microsoft, using multi-factor authentication blocks 99.9% of attempted account hacks.

What is the future of phishing?

It might have been around for almost twenty years, but phishing remains a threat for two reasons - it's simple to carry out - even by one-person operations - and it works, because there's still plenty of people on the internet who aren't aware of the threats they face. And even the most sophisticated users can be caught out from time to time.

For seasoned security personnel or technologically savvy people, it might seem strange that there are people out there who can easily fall for a scam claiming 'You've won the lottery' or 'We're your bank, please enter your details here'.

On top of this, the low cost of phishing campaigns and the extremely low chances of scammers getting caught means it remains a very attractive option for fraudsters.

Because of this, phishing will continue as cyber criminals look to profit from stealing data and dropping malware in the easiest way possible. But it can be stopped and by knowing what to look for and by employing training when necessary, you can try to ensure that your organisation doesn't become a victim.

MORE ON CYBER CRIME