Not to be confused with fishing, no. Phishing refers to the stealing of personal information like usernames, passwords and credit card details that can lead to identity theft.
Phishing attacks are serious business and they, unfortunately, continue to advance in sophistication. If you fall victim to phishing attacks and unknowingly relinquish sensitive information to a cybercriminal, you can place your financial data at risk.
From a phisherman’s perspective, no account is off limits. Don’t fall victim to their attacks—read on to find out the different types of phishing scams and learn tips to avoid them.
Aside from the puns we can produce from the homophone, other horrors associated with phishing attacks lay in how cunning and widespread they are. Phishing can manifest in many forms, the most common of which is email.
To really stress why this can be bad news, consider these facts:
Email is here to stay, and will only continue to increase in usage and importance. However, that only means more opportunities and greater incentives for cybercriminals to create malicious spam. For the most part, phishing is all about sending a massive amount of email in the hopes that unsuspecting recipients will click on links that will either download viruses onto their PCs or direct them to sham websites where they’ll be coerced into sharing personal information.
However, knowledge is security. Arming yourself with the knowledge of the different types of phishing scams will help you distinguish fact from fraud and hopefully prevent unnecessary financial consequences. The most common types are illustrated below.
1. Deceptive phishing
This is a type of phishing where there is a deliberate attempt to manipulate the recipient into giving up sensitive information. An example would be this fake PayPal email below where the reader is prompted to provide account information under the pretense of urgency.
Other examples include emails about system failures requiring users to re-enter their information, false charges to your account and too-good-to-be-true offers.
2. Malware-based phishing
This is a type of phishing where the primary goal is to trick the user into downloading malicious software onto their computer. Malware phishing can be in the form of links, attachments or downloadable files from a website.
An example of a malware-oriented phishing scam is this fabricated Adobe Flash Player email where the possibility of a security risk drives users to download an actual security risk. We do see the irony.
3. Social network website phishing
Thanks to the ubiquity of social media platforms, cybercriminals have yet another medium to scam people. Some examples include Twitter users receiving a message with attention-grabbing phrases such as, “You seen [sic] what this person is saying about you?” Clicking the link would direct them to a fake login page; if they entered in their credentials, an error web page is displayed and their account information is compromised.
Another more malicious example of social network phishing is targeting users with emails claiming that their passwords have been reset. An attachment is given to the users to provide their updated information; however, when opened, a malware program then steals all passwords from the user’s PC.
4. Keylogging or screenlogging phishing
This type of phishing stems from free web utility programs that hide information-stealing malware. Once installed on the user’s computer, the malware can track keyboard input and browser sessions.
Examples of utility programs include:
5. Spear phishing
This type of phishing targets specific people as opposed to random groups of people. An example of this would be receiving an email from someone on your contact list urging you to click a link or download an attachment within.
Once you fall victim to this, malware can be installed onto your PC or your login credentials can be stolen. This is particularly dangerous for users that have the authority to send checks or approve transfers within a company.
How to avoid falling hook, line and sinker for a phishing scam
Knowing the different types of phishing scams is the first step in preventing yourself from falling for one. Here are some tips you should follow to minimize that risk.
In 9 out of 10 cases, you will be able to ascertain the legitimacy of emails simply through common sense. For the remainder of the times when phishing scams are a little harder to recognize, just carefully reading through the body of the email and following the best practices above will help you figure out whether or not the sender is trustworthy.
What’s also important is keeping you and your organization out of trouble with regulators. If you’re in possession of a purchased email list for whatever reason, not taking the time to validate those addresses can really damage your sender reputation and overall email campaigns—so keep an eye out for phishy emails!
Want to learn more about how the importance of your digital reputation?