Phishing

Phishing is a form of online fraud in which an attacker pretends to be a trusted company, colleague or service to get someone to hand over credentials, card details or money. It usually arrives as an email, text message, social media message or ad, and leads to a fake website or a fake request. It is one of the most common ways criminals reach a brand's customers and employees.

How it works

The attacker picks a brand people already trust, such as a bank, a delivery company or a software provider, and copies its look. They register a lookalike domain or use a compromised website, install a phishing kit, and send a message that gives a reason to act now: a failed payment, a locked account, a parcel on hold. People who follow the link enter their details on the fake page, and the data goes straight to the attacker. Variants include spear-phishing aimed at specific people, smishing by SMS and vishing by phone.

Example

An illustrative case: customers of a fictional bank receive an email saying their card has been suspended. The link opens examplebank-verify[.]com, which shows the bank's logo and a login form. After the password, the page asks for the one-time code sent by SMS, which gives the attacker everything needed to sign in to the real account.

How to spot it

• The domain is close to the real one but not the same, or adds words such as secure or login.
• The message pushes urgency: account closure, a fine, a missed delivery.
• You are asked for a password, a one-time code or full card details through a link.
• The sender or reply-to address does not match the organization's usual domain.
• The greeting is generic and the wording or layout is slightly off.

What brands can do

Brands cannot stop criminals from copying them, but they can shorten the life of each attack:

• Monitor new domain registrations and certificate transparency logs for your brand name.
• Publish DMARC at enforcement so nobody can send mail from your exact domain.
• Give customers and staff a simple way to report suspicious messages, and act on reports quickly.
• Report confirmed sites to the hosting provider, the registrar and browser blocklists such as Google Safe Browsing.

Phishvoid's team verifies phishing sites aimed at your brand and handles the takedown with registrars, hosts and blocklist operators; you can reach the team here. For a broader introduction, read What is phishing.

Read more: What Is Phishing? Meaning, Types, Examples and Signs