Start with a different question… What is cybersecurity? It’s one that a lot of small businesses need to ask today. And the answers need to include information on phishing. What it is, what to do about it, and how it can affect your enterprise if you don’t do anything.

Phishing attacks are designed to trick you into giving up sensitive information. Cybercriminals use phishing emails to pose as credible institutions. They want personal details and to steal credit card information, or to install malware on a computer. A targeted attack can include malicious web links to fake websites.

A phishing attack is one of the cybersecurity terms you should know.

What is a Phishing Attack?

This is a type of cyberattack designed to steal sensitive data. Phishing attempts to trick and/or manipulate computer users. A phishing campaign can use email messages to set up network attacks, malware, and code injection to steal login credentials and other personal details.

By now you should be asking ‘What is a phishing scam?’ Read on to get all the answers you’ll need.

A Brief History of Phishing Attacks

Phishing awareness starts with an understanding of the history. If you’re asking what is phishing in cybersecurity you need to go back to the mid-1990s. That’s when people started using phony screen names.

It took off with the I Love You email that contained a malicious link, which was around 2000. Things are worse today. We can expect 6 billion attacks in 2022. Those kinds of phishing statistics are a good reason to keep an eye out. For suspicious messages and other tip-offs.

Types of Phishing

Phishing emails are a common problem for small businesses. But you need to be aware of other phishing attack types you can fall prey to. Add fraudulent data entry forms to the following list.

1. Spear Phishing

This type of phishing email is directed to a specific person, business, or organization. It’s disguised from a credible source but leads the user to a malicious website. Spear phishing targets include individuals or groups.

2. Email Phishing

A phishing email is an attack trying to get people to reveal things like financial information. Watch out for phrases like ‘Dear Account Holder’ and a request for personal information. Phishing emails like these are generic. What out for email addresses that aren’t official.

Simulated phishing emails are the ones that criminals send to test their efforts. This Microsoft office document talks about what to look for. Here’s some good info on spam filters too.

3. Vishing

Some phishing messages don’t get written down. Phishing messages take different forms, and vishing is short for voice phishing. This involves trying to cheat people over the phone and have them give up personal information. These include telling targeted users there is a problem with the bank account or credit card. Remember, call the organization and not the individual if you think it’s a scam.

The Federal Trade Commission wants you to report vishing to them.

4. Whaling

These are like other attacks but are designed to trick users in the C suite. A whaling attack targets senior officials. It’s a kind of CEO fraud where criminals pose as one of them.

These usually involve a request for a financial transaction. Employee awareness training about unsolicited contact is an important aspect of phishing education here.

5. Angler Phishing

There are many different types of phishing attacks, and this one centers around social media. A fake website and malicious tweets and posts persuade users to divulge data or download links to a malicious site. Watch out for these fake social media posts.

6. Smishing

Criminals use text messages here. SMS phishing might have an unusual area code. That’s one way to spot this kind of phishing content.

7. Clone Phishing

This type of phishing email comes from what looks like a service you use commonly. Suspicious emails will ask for personal information the service provider already has. Another business email compromise you need to watch for.

8. Water Hole Phishing

Criminals research the websites your employees visit like third-party vendors and industry news. Your staff is downloading malware when they visit these fake web addresses.

How to Recognize Phishing Scams

A successful phishing attack happens when you don’t know what to look for. Following are a few ways that you can detect phishing.

Bad Grammar and Spelling – Spear phishing campaigns aren’t effective when you spot these errors. Bad spelling might be legit, or it can be a way to get around filters that prevent phishing attacks. Grammatical errors top the red flag list in emails and on phishing websites.
Generic Greetings – Don’t supply account numbers online. Especially when your bank doesn’t know your name. Generic greetings from organizations you work with should tip you off. A “Dear Sir” email might be an attempt to get malware installed.
Email Domains That Don’t Match  – Reputable companies use their own email domains. Phishing emails have small errors, like microsOft or they get sent from a generic domain like Gmail. Phishing domains are a common method they use to get you to download malware.

Generally, you can look for malicious URLs with the misspelling in the email or domain name.

What Are Examples of Phishing?

Here are a few examples of this kind of malicious software that can result in financial and even identity theft. There are other phishing examples too.

Link Manipulation – This type has phishing links that lead to malicious websites. The fake web pages ask for account credentials.
Evil Twin Wi-Fi – Access points get spoofed. People get internet access to the wrong Hotspot. Watch out for access points in shopping malls, coffee shops, etc.
Malvertising – Advertising and pop-ups with links that install malicious code. Malicious links are common as are malicious attachments.

How Does a Phishing Scam Work?

Phishing uses email and other forms of communication. The criminal usually poses as a legitimate company like a bank or supplier. The sender is trying to get access to sensitive information such as Like bank account numbers or admin passwords.

Victims could be tricked into clicking a link to a phishing website, as the scams vary. Some hackers use false social media profiles.

Basic attacks attempt to trick people into entering confidential information or personal details. Prizes won in false competitions and winning vouchers are common techniques.

Finally, here’s a list of the best phishing training options for you and your employees.

Image: Envato Elements

This article, “What is Phishing?” was first published on Small Business Trends