How Phishing Is Used to Trick Us and Why It Is Successful for Cybercriminals

Phishing is the most popular form of cybercrime and for good reason.  It's easy.  Most phishing techniques are automated, so the hackers barely have to lift a finger from a technological side.  The most difficult part is the social engineering side: They must convince people to perform an action for it to be successful.  They must trick people out of useful and valuable information such as banking credentials, credit card details, or access to their contacts. It's up to individuals to learn how to identify phishing attempts and avoid them.

Here are a few tips:

• Don't click links sent in email messages or those found on social media.  It's better to manually type them into the address bar, regardless of who sent them.

• If a message comes from an unknown address with a link or attachment, be very suspicious. Likely it's phishing.

• If anti-malware software is not installed on all devices that connect to the Internet, make sure that it is and that it's updated often; even if you have an Apple product. They too are now susceptible to malware.  Do thorough scans regularly.

• Secure all mobile and devices. Install anti-malware from a reputable company and keep it updated. 

• Don't believe everything you read and don't panic.  Look at the links in the messages and make sure they make sense before doing anything.  If you hover over links, most of the time you can see where that link will go and often, it doesn't make sense. Therefore, don't click it.

• Remember that financial institutions won't call you randomly and ask for account information or credit card details. They also won't ask you to update account details by clicking a link in an email. If it's necessary to update that information, go to the online site directly or via a previously bookmarked link that you trust.

• Trust your instincts. If they are telling you something isn't quite right, do some research before going further.

• Be aware of an increase in phishing attempts during highly publicized events.  They increase around those times, particularly on social media.

• If you need to contact someone as a result of getting an email message, find the contact details in some other way besides what is provided in the email.  Scammers will often times staff their scams with "support personnel" and provide contact details to those people in the email. Don't fall for it.

Information gained from phishing is used in various ways by the criminals.  Sometimes they do indeed want to get access to bank accounts, but in other cases, they want access to contacts in order to send spam or to sell something. Large lists of contacts can be sold to other cybercriminals who may use it spread malware, or potentially to marketers and advertisers who want to sell products.  Either way, any information phishers collect is worth something; and sometimes a lot.

Phishing works because most people likely will try to take advantage of a free gift and most people would want to find out why the Internal Revenue Service (IRS) thinks they didn't pay taxes, when indeed they did (there are numerous IRS scams working on this theory). When phishers send links in emails with such messages, many people will click them.

These types of things appear all the time, but also will take advantage of various events that get a lot of attention. During large sporting events such as the Olympics, scammers will try to convince fans that by clicking a link, they will get free tickets to some event, for example.  When a celebrity passes away, they will take advantage by posting various stories with malicious links hoping people will want to know some additional details about the person. When Robin Williams passed away, a fake message claiming to be his farewell video message appeared all over social media. However, if the link was clicked, an online banking malware was installed on the computer. 

Using social media can be extremely lucrative for cybercriminals because they can reach millions of people without effort.  Kaspersky Labs reported that out of more than 600 million phishing attempts that it was able to detect, 22% of them dealt with Facebook alone.

Stay aware of social engineering and scams propagated via email and social media.  Learn how to identify the fake ones and you are much less likely to fall victim.