Phishing

Phishing is a way that unkind people try to get important information from others or make them use harmful software. These tricks can look very real, often copying the style of real websites, which makes it hard to know they are not real. Because of new technology, these tricks have become more clever and are now a big problem around the world.

The word "phishing" started being used in 1995 and comes from the idea of "fishing" for information, where attackers use lures to get what they want. To stay safe from phishing, people need to learn how to spot these tricks, use special safety tools, and be careful online.

Phishing can happen in many ways, like through emails, phone calls, text messages, or even QR codes. As these tricks keep changing and getting more advanced, it is very important for everyone, both at home and work, to know how to protect themselves.

Types

Email phishing

Phishing attacks often come through email. They try to trick people into sharing important information or passwords. Many of these emails are sent to large groups at once. The goal can be to steal money or put harmful software on a computer. Sometimes, these emails look like they are from places you trust, like a bank. They might tell you to click a link, but the link leads to a fake website.

Spear phishing

Spear phishing is a more focused type of attack. These messages look like they are from someone you know or a place you trust. They might target people who have access to important information. These attacks can use many ways to contact you, like email or phone calls, to make you act fast.

Voice phishing (Vishing)

Main article: Voice phishing

Vishing, or voice phishing, uses phone calls to trick people. Attackers might call many people, pretending to be from a bank or another trusted group. They might ask for important information. This type of attack works because people often trust phone calls.

SMS phishing (smishing)

Smishing uses text messages to try to trick people. The messages might ask you to click a link, call a number, or email someone. They might pretend to be from a company you use or someone you know. It’s important to be careful with unexpected messages, especially if they ask for personal details.

Page hijacking

Page hijacking tricks people by changing real websites to harmful ones. Attackers might add harmful code to a website, leading you to a fake page that tries to steal your information.

QR code phishing (quishing)

Quishing uses QR codes to trick people. Attackers might put a harmful link inside a QR code. When you scan it, you might be taken to a fake website that tries to steal your details. As QR codes become more common, it’s important to only scan codes from places you trust.

Man-in-the-Middle phishing

Some phishing attacks use special tools to catch information while you’re using a website. These tools act like a middleman, letting attackers use your account. This makes it harder for security systems to spot the attack.

Techniques

Phishing attacks use tricky links that look like they come from real companies but lead to fake websites. These links might misspell words or use special web addresses to fool people. When you hold your mouse over a link, some tools can show where it really goes.

Phishing also tricks people into doing things they shouldn’t, like clicking a bad link or sharing private details. Attackers might pretend to be someone you trust, like a bank, and say there is a rush, such as your account being closed. Sometimes, they use fake news stories to get people to click harmful links. These links can lead to websites that look real but are used by attackers to try to put harmful software on your device.

History

Main article: List of phishing incidents

Early phishing tricks began in the 1990s when some people used online chat to try to get private information from others. The word "phishing" started from a tool made in 1994. This tool let people pretend to be support staff and ask for passwords.

In the 2000s, these tricks became more common. They tried to take money from online payment systems and banks. Many people lost money because of these tricks, especially in the United Kingdom.

In the 2010s, phishing grew a lot. Some big companies and governments were targeted. For example, in 2020, hackers tricked employees at a big social media site into sharing passwords. They then used this to take over famous people's accounts.

Today, phishing keeps changing. Hackers use clever tricks to look like trusted websites or services.

Anti-phishing

Anti-phishing websites show messages that have been spreading online recently, like FraudWatch International. These sites give details about these messages.

Until 2007, not many businesses used ways to stop phishing. There are different methods to fight phishing, like laws and technology. People and groups can both take steps to protect information. Phishing through phone, websites, or email can be reported to the police, as explained below.

User training

Learning about phishing is important for any group trying to stop it. Training helps people spot common signs of phishing, such as:

• Asking for personal information
• Not matching email addresses and website addresses
• Unusual greetings
• Misspelled words or mistakes
• Requests that seem urgent
• Unusual attachments
• Low-quality pictures

Almost all real emails from companies have something special that scammers can’t easily copy. For example, PayPal talks to customers by their username, so an email that says “Dear PayPal customer” is probably not real. However, just having personal information doesn’t always mean the email is safe.

Some studies show that games can help teach people about phishing and make them more careful.

The Anti-Phishing Working Group reports on trends in phishing attacks.

Technical approaches

Filtering out phishing mail

Special spam filters can stop many phishing emails from reaching people’s inboxes. These filters use methods like machine learning and natural language processing to find and block emails with fake addresses.

Browsers alerting users to fraudulent websites

Some web browsers have lists of known bad websites and check addresses against these lists. Browsers like Google Chrome, Microsoft Edge, Mozilla Firefox, Safari, and Opera include these checks. Some browsers get help from trusted partners or special tools. One way to fight phishing is to use a special DNS service that blocks known phishing addresses.

Augmenting password logins

Some websites ask users to pick a personal picture that shows when they log in. Users are told to only enter their password when they see their picture. Other methods include showing a colored word in a box or a changing grid of pictures that users must identify before entering their password.

Monitoring and takedown

Some companies help find and remove bad websites and accounts that copy real organizations. People can help by reporting phishing to groups like cyscon or PhishTank. Phishing websites and emails can also be reported to Google.

Multi-factor authentication

Groups can ask for more than just a password when logging in, like a smart card and a password. This helps protect information even if a password is stolen. Some newer methods, like WebAuthn, are designed to be harder to bypass.

Legal responses

In 2004, the U.S. Federal Trade Commission filed a lawsuit against someone for creating a fake America Online page. Other countries have also arrested people for phishing.

Companies have also taken action. In 2005, Microsoft filed lawsuits in the U.S. against people accused of taking passwords and secret information. In the same year, Microsoft and the Australian government worked together to teach police how to fight cyber crimes, including phishing.

In 2007, a man in California was the first to be found guilty under a law about unwanted emails. He was sentenced to 70 months in prison.

Notable incidents

2016–2021 literary phishing thefts

Sector-specific impact

Healthcare

Phishing is a big problem in healthcare, especially in the United States. Hackers often use emails to trick people into sharing important health information. This is a common way hackers start attacks in healthcare.

New rules were suggested in December 2024 to help stop these attacks. These rules aim to make it harder for hackers by adding extra steps to log in, special training for workers, and better tools to find bad emails. These ideas came after large attacks, like one in 2024 that affected many people's health records.