What Is Phishing and How to Protect Yourself From It | Free Antivirus Software

Phishing (phishing, from fishing - fishing, fishing) is a type of Internet fraud, the purpose of which is to obtain user identification data (logins and passwords to bank cards, accounts).

Most often, phishing is the mass mailing of letters and notifications on behalf of well-known brands, banks, payment systems, postal services, and social networks. Such letters, as a rule, contain a logo, a message, and a direct link to a site that is outwardly indistinguishable from the real one. The link is required to go to the site of the "service" and, under various pretexts, enter confidential data in the appropriate forms. As a result, fraudsters gain access to user accounts and bank accounts.

The term phishing appeared in 1996 on the alt. online service. America-Online Usenet newsgroup. The first mentions of phishers were associated with the media company AOL, when the scammers presented themselves as AOL employees, reached out to users via instant messaging programs, After gaining access to the account, it was used to send spam.

In the early 2000s, phishing spread to payment systems, and in 2006, users of the MySpace social network were subjected to phishing attacks, as a result of which their credentials were stolen.

What is the purpose of phishing

Phishing attacks can target both individuals and individual companies. The purpose of attacks on individuals organized by fraudsters, as a rule, is to gain access to logins, passwords, and account numbers of users of banking services, payment systems, various providers, social networks, or postal services. 

Not all phishers cash out the accounts they access on their own. Cashing out accounts is a difficult process from a practical point of view. In addition, it is easier to catch a person who is engaged in cashing in and bring a criminal group to justice. Therefore, having received confidential data, some phishers sell them to other scammers who use proven schemes for withdrawing money from their accounts.

In cases where phishing attacks are directed at companies, the goal of cybercriminals is to obtain the account information of an employee and then an extended attack on the company.

Types of phishing attacks

The main phishing techniques and techniques include:

Social engineering techniques

A person always reacts to events that are significant for him. Phishing organizers try to alarm the user and provoke an immediate reaction. For example, an email with the heading “to regain access to your account” is believed to grab attention and force the person to follow the link for more information.

Phishing with deception

This is the most common type of phishing attack. Fraudsters can spam millions of email addresses in a matter of hours with emails based on this method. In this case, the phisher sends a fake letter on behalf of the organization asking to follow the link and verify the account details.

To steal personal data, special phishing sites are created, which are placed on a domain that is as close as possible to the domain of a real site. To do this, phishers can use URLs with small typos or subdomains. A phishing site has a similar design and should not arouse suspicion among the user who lands on it.

It should be noted that fraudulent phishing is the most traditional method of phishers and, at the same time, the least secure method for attackers, so it is gradually becoming a thing of the past lately.

Spear phishing

Harpoon phishing targets specific people rather than broad groups of users. Most often, this method is the first step to overcome the company's defenses and conduct a targeted attack on it. Attackers in such cases study their victims using social networks and other services and thus adapt messages and act more convincingly.

"Whaling"

The hunt for confidential information of top managers and other VIPs is called "whale hunting." In this case, phishers spend a lot of time determining the personality traits of the target victim to find the right moment and ways to steal credentials.

Virus distribution

In addition to identity theft, fraudsters also aim to harm individuals or groups of individuals. When clicked, the link of a phishing email can download a malicious virus to your PC: a keylogger, Trojan, or spyware.

Farming

This is a new type of phishing. Using this method, phishers receive personal data not through a letter and following a link, but directly on the official website. Farmers change the digital address of the official website on the DNS server to the address of the spoofed site, and as a result, the unsuspecting user is redirected to the fake site. Such phishing is more dangerous than traditional phishing since it is impossible to see the spoofing. eBay auction, PayPal payment system, and well-known world banks are already suffering from such attacks.

Wishing

The notification letter indicates the phone number to call back to eliminate the "problem that has arisen". Then, during the conversation, the operator or answering machine asks the user to provide identification data to solve the problem.

How you can protect yourself from phishing

In response to an email requesting "confirmation" of an account or any other similar request, experts advise users to contact the company on whose behalf the message was sent to verify its authenticity. In addition, we recommend that you enter your organization's URL yourself in the address bar instead of using any hyperlinks.

Almost all genuine messages from the services contain mentions of some information that phishers cannot access, for example, the mention of a name or the last digits of an account number. At the same time, any letters that do not contain any specific personal information should cause suspicion.

It should also be remembered that phishing sites can hide behind pop-ups. Targeted advertising can run on them. There are times when in the "login" column the user already sees his email address and he is only asked to enter the password in the lower column. It is possible to see a link to a phishing site in comments on forums and social networks. A link can also be sent to you by a friend or acquaintance whose account has been hacked. If a letter or link has aroused suspicion in you, it is better not to follow it.

The fight against phishers also takes place at a technical level:

Browsers warn about phishing threats, most of them maintain their own lists of phishing sites, after checking with them, services warn users about going to dangerous sites;

Mail services fight phishing in messages by improving their spam filters and analyzing phishing emails;

Large services and companies are also complicating the authorization procedure, offering users additional protection of personal data. free antivirus software safe your pc and laptop from viruses,