What is a Phishing Attack? And how to avoid it?

What is Phishing? 

Phishing is one of the easiest forms of cyber attack for criminals to carry out and one of the easiest to fall for.

 

It’s also one that can provide everything hackers need to make fool their target’s personal and work accounts, usually carried out over email.

 

Although the phishing has now spread beyond suspicious emails to phone calls a.k.a. vishing, social media messaging services a.k.a. smishing, and apps a.k.a. malvertising.

 

A basic phishing attack attempts to trick the target into doing what the scammers want.

 

Let’s dive right into what phishing is and how to avoid this.

 

The term phishing with a pH is a spin the word Phishing because criminals are dangling a fake lure, a legitimate-looking email, website or ad, hoping users will bite by providing the information that the criminals have requested, such as credit card numbers, account numbers, passwords, username, and other valuable/confidential information.

 

And how do they do this?

 

Methods of Phishing

Well, this is usually done by including a link on quote phishing messages that appear to take you to the company’s website to fill in your information.

 

But the website is a clever fake and the information you provide goes straight to the crooks behind the scam.

 

Phishing goes all the way back to the last century. Yet as digital technologies progress, this technique continues to find new ways to exploit vulnerabilities.

 

Types of Phishing Attack 

Here are the most common phishing techniques nowadays.

 

Standard Email Phishing  

Well! This is the most widely known form of phishing; this attack is an attempt to steal sensitive information via an email that appears to be from a legitimate organization. It’s not a targeted attack and can be conducted in mass.

 

Malware Phishing 

Malware phishing uses the same techniques as email phishing, but this attack encourages the target to click the link or download an attachment. So some kind of virus can be installed on the device.

 

It’s currently the most pervasive form of a phishing attack, as it can not only compromise some of your information but your whole device.

 

Spear Phishing

While most phishing attacks cast a wide net, spear phishing is a highly targeted, well research attack, generally focused at public personas, business executives, and other lucrative targets.

 

Smishing

SMS enabled phishing delivers malicious short links to Smartphone users, often disguised as accounts notice, prize notification, and political messages.

 

Vishingor voice Phishing 

It involves a malicious caller who claims to be from tech support, a government agency, or any other organization and tries to extract personal/confidential information such as banking or credit card information.

 

Malvertising

This type of phishing utilizes digital ad software to publish normal-looking ads with malicious code implanted within.

 

Example of Phishing Attack 

Even though there are numerous forms of phishing, the one that most people fall for is email scamming, make no mistake, these attacks can be quite clever.

 

After all, these types of phishing exist because they work. Luckily for you, there are numerous warning signs that can help you to detect this type of phishing.

 

And what better way to learn them with an example.

 

Imagine this, you receive an email from Amazon claiming your account has been locked. You check the email and see that-

 

1.  The email is not addressed to your email address. 
2. The header is addressed to the dear customers, instead of a personalized identifier that includes your name.
3. A label that includes some text as exceeding the number of attempts allowed appears.
4. A lot of visual errors pop up, words are capitalized throughout the text punctuation and the formatting is off
5. The email tries to reassure you by encouraging you to confirm this information using the link they provide. Yet if you hover over the links on the page, another web address appears.

 

All of these elements are warning signs that the email must be a scam.

 

First of all, if you were truly being notified by a company that there was an issue with your account, they would know your name and email already, then if you recall correctly, you must know that you haven’t attempted to sign in to your Amazon account lately.

 

Thus, the information claiming that you exceeded the number of attempts allowed is false.

 

Yet this is where most of the people fall for the scam as they think somebody must be entering into my account, i need to change my password.

 

Well, if you suspect this, don’t click the links on the email and go to the web page directly. Here you can truly see if people attempt to enter your account and you can change your password if you desire to.

 

As most of us only tend to skim through emails, visual errors, and false links are easier to miss.

 

Still, it’s important to be aware that if a message is asking for sensitive information, we must be sure that we can trust it. Reading this message thoroughly is a great way to spot these warning signs and avoid being scammed.

 

How to Prevent Phishing Attack? 

Now that you took the first step on learning what phishing looks like; here are some things to do to avoid falling for them and encountering them in the future

 

1. Don’t click on the phishing link

As I said before, it’s not advisable to click on a link in an email or instant message even if you know the sender. The bare minimum you should be doing is hovering over the link to see if the destination is the correct one.

 

Some phishing attacks are fairly sophisticated, and the destination URL can look like a carbon copy of that genuine site that’s set up to record keystrokes or steal login or credit card information.

 

If it possible for you to go straight to the site through your search engine, rather than click on the link, then you should do so

 

2. Get free anti-phishing add-ons

Most browsers nowadays will enable you to download add-ons that spot the signs of a malicious website or alert you about the known phishing sites, they’re usually completely free, so there is no reason not to have this installed on every device in your family and friend circle.

 

3. Don’t give your information to unsecured or phishing websites

If the URL of the website doesn’t start with HTTPS, or you can’t see a closed padlock icon next to the URL don’t enter any sensitive information or download files from that site.

 

Sites without security certificates may not be intended for phishing scams, but it’s better to be safe than sorry.

 

4. Rotate password regularly

If you have got online accounts, you should get in the habit of regularly rotating your password, so you prevent an attacker from gaining unlimited access.

 

Your account may have been compromised without you knowing, so adding that extra layer of protection through password rotation can prevent ongoing attacks and lockout potential attackers.

 

5. Don’t ignore browser/application updates

Receiving numerous update messages can be frustrating, and it can be tempting to put them off or ignore them altogether.

 

Don’t do this.

 

Security patches and updates are released for a reason. Most commonly to keep you up to date with modern cyber attacks method by patching holes in security.

 

If you don’t update your browser, you could be at risk of phishing attacks through known vulnerabilities that could have easily been avoided.

 

6. Don’t give out important information unless you must

As a general rule of thumb, unless you 100% trust the site you are on, you should not willingly give out your credit card or any confidential information.

 

Make sure if you have to provide your information, verify the website is genuine, the company is real, and the site itself is secure.

 

Hope you liked the article; if you liked it please share it with your friends and family so that no one falls into such scams.