What Phishing Is and How Phishers Trick Their Victims

Phishing is a form of social engineering in which an attacker uses deception to coax a victim into handing over personal or sensitive information. It can take many shapes. So far the most common have been forged emails and websites, phone calls and text messages.

Two common lures

One typical ploy is a survey with a prize promised at the end. On the face of it there is no harm in filling it in. Depending on what the victim reveals, though, the answers can be put to all sorts of dishonest uses, from breaking into the victim's accounts to setting up later scams and other criminal activity.

Another favourite is the fake "suspicious activity" alert. The message claims that the recipient's email or bank account may have been compromised and urges them to sign in and change the password. The link, however, leads to a spoofed site that captures whatever login details are typed in and passes them straight to the attacker.

Why the fakes are hard to spot

Phishing messages are built to appear authentic, and criminals keep refining their techniques so that each attempt is more believable than the last. Some go as far as reproducing a real organisation's website layout or email design down to the last detail. Attackers can also make links look almost identical to genuine ones, which is why any link arriving by email or text message deserves caution.

Phishing comes in several varieties. Spear phishing aims at one particular person or organisation, and it tends to be more dangerous because the scammers research their target far more thoroughly beforehand, using whatever means they can, for instance combing through the company's website or social media accounts or following its staff online.

Data has become more valuable and more important to individuals and organisations alike, so the fallout from a successful phishing attack can be severe. It can include breaches of data and intellectual property, along with heavy financial losses and lasting damage to reputation.