How does Phishing Work?

Just like dangling bait to attract fish, phishing involves dangling something to entice users to reveal sensitive secret data. Read on to learn more about what phishing is and how it works.

What Is Phishing?

Phishing is an online scam where a scammer sends an email, telephone or text message that appears to come from a legitimate source. The message may come with a variety of requests but usually asks the recipient to provide important personal data — banking and credit card information, credentials, passwords, etc. The scammers can then use this information to access financial accounts and steal their victims’ money, among other tricks.

Why Is It Called “Phishing”?

In the 1990s, America Online (AOL) was the hottest thing on the Internet, and some people found that it could be profitable for them to steal and sell AOL passwords. These online thieves would “fish” for these passwords by luring people using an email that looked as if they were sent by a bank or some reputable financial institution. 

The email would present some bogus reason and ask the recipient to re-enter their account information, including passwords. Not all would fall for this con, but some people would take the “bait.” And so “fishing” for passwords became a thing. The spelling was changed to “phishing” as a throwback to earlier days when hacking came in the form of “phone phreaking”.

How Can I Tell If an Email Is a Phishing Attempt?

These days, it may be difficult to tell if an email is legit or if it is an attempt to phish for your password. Before you click on anything, take note of some telltale signs of a scammy email.

• The offer is too good to be true: You may receive emails saying you’ve won a trip around the world. But remember that the whole point is to get you in a state of jubilation so that you don’t think too clearly about your actions.

• The message tries to rush you: Phishers often try to rattle you into acting without thinking by imposing a time limit, or a finite quantity of whatever it is they are baiting you with. Again, the whole point is to fire up your emotions so that you act without thinking through the logic of the message.

• Hyperlink “traps”: This means that the source of a hyperlink is inconsistent with the destination. Before you click on any hyperlink, hover your mouse above it and carefully examine the corresponding URL. If the message claims to be from a reputable company such as Google, for example, then why doesn’t the URL point to Google’s domain? Or why is “Google” spelled incorrectly?

• Suspicious attachments: Malware often spread through attachments in phishing emails. Beware of files from unknown senders, especially if these have extensions such as EXE, .DOCM, .JAR, and other ones you do not frequently see. In short: If it doesn’t make sense, don’t open it.

Is Phishing Illegal?

It absolutely is! In the real world, any action that intentionally deceives someone else for money or personal gain is considered fraud. In cyberspace, it’s pretty much the same thing. An email that misrepresents itself by pretending to be from a legitimate source, but is actually intended to deceive people into giving up personal information is a fraudulent practice and is illegal.

How Can I Protect Myself from Phishing?

Here are some ways you can protect yourself from phishing:

• Use SPAM filters: These are pretty good at detecting if a message is questionable. Sometimes, though, they may block out an email from legitimate sources.

• Navigate the web safely: Set up your browser so that they only allow trusted websites to open, for example.

• Be safe with passwords: Choose passwords that are hard to guess, change them regularly, and do not use the same ones for multiple accounts.

• Be cyber cautious in general: If you are asked to submit your access credentials, call the company through known legitimate channels to verify if they indeed require this.

Large organizations can take extra steps in order to avoid phishing scams. They can use AI tools to detect patterns in data, conduct phishing attack tests, and deploy various prevention tools. For instance, they can identify connections between IP addresses and hostnames with DNS and IP history tools to learn if some of their IP addresses might have connections with dangerous domains. Additionally, they can track domain and DNS registrations to proactively block suspicious URLs.