WHAT IS PHISHING?

This is the most common phishing tactic. An email is sent to multiple recipients urging them to update personal information, verify account details, or change passwords.

Typically, the email is worded to promote a sense of urgency, sometimes highlighting the recipient’s need to protect themselves or their organization. The email is designed to appear to come from a legitimate source, such as customer service for PayPal, Apple, Microsoft, a bank, or other known companies.

A familiar-looking webpage, like an email account login page or online banking page, is injected with malicious content. The content can include a link, form, or pop-up that directs people to a secondary website where they are urged to confirm personal information, update credit card details, change passwords, etc.

A carefully worded email arrives with a malicious link to a familiar website such as Amazon or another popular website. When the link is clicked, it takes people to a fake website designed to look exactly like the known website, where they are then prompted to update their account information or verify account details.

This common type of domain spoofing includes sending emails that masquerade as coming from the CEO, human resources, or a colleague. The email may ask the recipient to transfer funds, confirm an e-transfer or wire transfer, or send tax information.

Hackers create fake websites that look just like a highly frequented website. This fake website has a slightly different domain, for example, outlook.you.live.com instead of outlook.live.com. People believe they’re on the right website and accidentally open themselves to identity theft.

Mobile phishing can involve fraudulent SMS, social media, voice mail, or other in-app messages informing the recipient that their account has been closed, compromised, or is expiring. The message includes a link, video, or message to steal personal information or install malware on the mobile device.

Spear phishing is advanced targeted email phishing. The criminal targets a specific individual or organization and uses focused, personalized messages to steal data that goes beyond personal credit card information. For example, infiltrating a hospital, bank, or university to steal data severely compromises the organization.

With voice phishing or vishing, a phone caller leaves a strongly worded voicemail or reads from a script that urges the recipient to call another phone number. Often these calls are designed to be urgent and encourage the recipient to act before their bank account is suspended or, worse, they may be charged with a crime.

This type of phishing requires sophisticated techniques that allow criminals to violate a web server and steal information stored on the server.

This type of malware uses online advertisements or pop-ups to encourage people to click a link that installs malware on the computer.

Malware happens with a person clicks an email attachment and inadvertently installs software that mines the computer and network for information. Keylogging is one type of malware that tracks keystrokes to discover passwords. A trojan horse is another type of malware that tricks someone into entering personal information.

With man-in-the-middle phishing attacks, the criminal tricks two people into sending information to each other. The phisher or criminal may send fake requests to each party or alter the information being sent and received. The people involved believe they are communicating with each other and have no idea a third party is manipulating them.

A fake Wi-Fi access point is created that acts as a legitimate Wi-Fi hot spot. This tactic is common in coffee shops, airports, hospitals, or locations where people routinely need Wi-Fi access. People log into this Wi-Fi access point thinking they’re using the legitimate spot, allowing criminals to intercept any data communicated on this fake Wi-Fi account.