What is Phishing?

"Phish" is pronounced like the word "fish" - the analogy is that anyone who throws a backed hook out (phishing email) and expects you to bite. Phishing is a crime where people share their confidential information like passwords and credit card numbers with hackers.

There is more than one way to reel in the hunt with real fishing, but the phishing strategy is the most common.

When the victim opens the email, then they see a scary message to overcome by their better judgment by filling them in fear. The message demands immediate action; otherwise suffers some consequences.

Phishing is a cyber-attack which uses the email as a weapon.

For example, a note from someone in their company, click on a link or download an attachment.

How does phishing work?

Phishing begins with a fraudulent email or communication designed to entice a victim. A trusted sender sees the message. If they fool the victim, they are mobilized to give confidential information on the scam website.

There are following Phishing techniques used by attackers:

• The attackers embedded a link in an email that redirects employees to an unsafe web that requests sensitive information.
• They set up a Trojan by malicious email attachments or advertisements to allow intruders to obtain sensitive information.
• It separates the sender's address in the email as a source and requests our sensitive information.
• Phishers get company information by calling a company vendor.

Prevent Phishing Attacks

Educate the employees to protect the organization from phishing. They often target high-level executives. We must ensure with the following points to prevent the phishing attack.

• Always consider the email password as a state key, as it is for spammers.
• Use a short phrase for the password instead of just a few characters and regularly change it.
• Do not share email passwords with anyone.
• Never click on any email link but type the address into the address bar.
• Keep your desktop always updated. Install antivirus solutions, and monitor antivirus status.
• Develop a security policy.
• We have to encrypt our sensitive and confidential information.

Identify a Phishing Attack

Phishing is initiated by email communication, but there are also many ways to distinguish suspicious messages from legitimate messages. Data leaks occur when employees do not have the necessary knowledge to protect important company data.

• An email with general greetings: Phishing emails include standard greetings such as "Hello Bank One Customer" instead of using the recipient's real name. It launched in bulk, but the spear-phishing attacks will be individual.
• The email requesting personal information: Most companies never email customers or ask them to enter their login credentials. It is a security measure to help protect consumers from fraudulent emails.
• Emails with emergency messages: Most phishing emails create a sense of urgency to lose important information.
• An email with a spoofed link: Notice the URLs starting with HTTPS. Here "S" indicates that the website is protected and trusted.

Usually a phishing mail includes:

• 'Too good to be true' proposal
• Unusual sender
• Misspelling and grammar
• Threats to closed accounts convey a sense of urgency.
• Do not open attachments, like .exe files.

Types of Phishing Attacks

There are eleven types of phishing that are widely used by the attackers.

Standard E-mail Phishing: It is the most common and easiest way of phishing. It aattempts to steal sensitive information by emails that appear to be from a legitimate organization.

Malware Phishing: Using the same email phishing techniques, it encourages targets to click on links or download attachments so that the malware can be installed on the device.

Spear Phishing: Spear phishing focuses on business officers, public personalities, and other lucrative targets.

Smishing: It is SMS-enabled Phishing that distributes malicious short links to Smartphone users. It comes as account notices, award notifications, and in political messages.

Vishing: Vishing is a malicious calling from a government agency or any organization. They try to extract our personal information, such as banking or credit card information.

Clone Phishing: In this type of attack, a shadowy actor tamper with a person's email account, maliciously swapping a valid link, attachment, or any other element, changes existing email and spreads the person's message to spread the infection.

Man-in-the-Middle Attack: The attacks are happened by building public wi-fi networks at shopping malls or public places. Once involved, the middle man can fish for information or run malware on devices.

BEC (Business Email Compromise): A commercial email agreement includes an email request from someone or a target company requesting immediate action, be it a money transaction or a gift card. The strategy is estimated to account for about half of all cybercrime-related trade losses in 2019.

Whaling- Whaling targets high-profile and senior executives in an organization. The content of the whaling effort will exist as a routine communication or high-level executive business.

Example of a Phishing E-mail:

Suppose you saw any messages in your inbox. Do you see any indication that it is a scam? Let's have a look.

• The email looks like it is from a company that you trust easily.
• A normal greeting in the email is, "Hi Dear." If we have an account with the business, it won't use a common greeting in this way.
• It invites you to click on a link to update the payment details and look as genuine as a bank website.

We can use the following steps to protect ourselves from the phishing attack.

1. Protect the computer by using security software.
2. Update mobile phone by setting software to protect against hackers. These updates can give you significant protection against security threats.
3. Protect your accounts using multi-factor authentication. Some accounts provide additional security by requiring two or many credentials to access our account. It is called multi-factor authentication. The additional credentials we need to log into your account fall into two categories:
   • You have some passcodes that you get by a text message.
   • Sometimes we are scanning your fingerprint, eye retina, and face.
   If they receive your username and password, multi-factor authentication makes it difficult for scammers to log into your accounts.
4. Back up your laptop and phone data, keep it saf