Back to Security Basics: Understanding Phishing

Phishing continues to be a widespread cyber threat, posing significant financial and personal risks to both individuals and organisations. We will examine what phishing is, how it works, and what steps you can take to protect yourself.

Since mobile devices often don't have the same strong security features as laptops and desktops, it's crucial for users to be especially vigilant against phishing attacks. The following information will help you understand phishing, recognise the warning signs, and know what to do if you become a target.

what is Phishing and how it works.

Phishing is a malicious strategy used by cybercriminals to acquire sensitive information, such as login credentials and credit card numbers. It typically involves an attacker masquerading as a reputable entity, tricking the victim into opening a message and clicking on a malicious link. This link often redirects to a fake website designed to capture the victim's information.

Despite its straightforward nature, phishing is highly effective, resulting in significant data breaches and financial losses. According to IBM's 2023 Cost of a Data Breach Report, phishing accounts for 15% of all data breaches, with an average cost of $4.9 million per incident.

hishing attacks generally start with an unsolicited message via email, text, or an app aimed at persuading the recipient to click a link. These messages often lure victims with promises of rewards, such as a new iPhone or a free vacation, or claim to offer access to familiar services like social media or banking.

Once the victim clicks the link, they are taken to a convincing-looking site that requests personal information. This data can be used immediately for fraudulent activities or sold on the dark web.

common types of Phishing attacks

Phishing can manifest in several ways, including:

• Smishing: Involves text messages containing links to phishing sites.

• Whishing: Similar to smishing, but sent via WhatsApp.

• Email Phishing: Often targets corporate emails, mimicking trusted brands or services.

• Vishing: Phone-based scams that deceive victims into providing financial information.

• Spear Phishing: A targeted approach, often impersonating someone the victim knows.

• Whaling: Targets high-profile individuals like executives.

• Social Media Scams: Uses posts or direct messages to lead victims to phishing sites.

recognising Phishing attacks

To prevent becoming a victim of phishing, be alert for these warning signs:

• Unsolicited messages with shortened or suspicious links.

• Web pages requesting personal details.

• Emails with unexpected language or tone.

• URLs that look legitimate but contain subtle differences.

• Poor grammar or spelling in messages, though attackers are becoming more sophisticated.

For instance, a phishing attempt might include a shortened link and an urgent call to action, such as disputing a fake purchase. The best course of action is to ignore the link and manually check your accounts.

what to do if you've been Phished

If you suspect you’ve fallen for a phishing attack, act swiftly:

• Change passwords for any compromised accounts.

• Cancel your credit card if you've shared its information.

• Disconnect from the internet to prevent the attack from spreading.

• Notify the entity impersonated in the attack.

• Scan your device for malware.

• Monitor for identity theft signs and consider placing a fraud alert on your credit accounts.

preventative measures

Protecting yourself from phishing requires vigilance:

• Avoid clicking on suspicious links.

• Refrain from entering credit card information on unfamiliar sites.

• Manually type URLs for banking or sensitive services.

• Be skeptical of offers that seem too good to be true.

• Verify URLs in the address bar.

• Change passwords regularly.

• Don’t use the same password more than once, consider using a password manager eg: Lastpass; 1Password; Bitwarden, to name a few.

Organisations can also bolster security by:

• Educating employees about phishing.

• Implementing anti-spam measures.

• Using multi-factor authentication.

• Deploying threat prevention software.

• Keeping devices and software up to date.

By staying informed and cautious, you can significantly reduce the risk of falling victim to phishing attacks and safeguard your sensitive information.