What is phishing and how to avoid falling for scammers’ tricks

Today, it is difficult to imagine modern life without the Internet and all its attractions. We use various payment services, pay utility bills, shop online, communicate, and work. Every day, Internet users transfer huge amounts of data (including confidential information) that is not always protected. To avoid becoming a victim of malicious individuals who want to take advantage of this, it is enough to follow basic safety rules.

Internet phishing: what is it?

Phishing is a type of online fraud aimed at obtaining confidential information by illegal means. This method is most common in emails, with 96% of all phishing attacks occurring via email. 3% are carried out through fraudulent websites, and 1% via telephone.

The term itself comes from the English word “phishing” — fishing. The essence of the fraud is that users, through carelessness, disclose their confidential data (phone number, cards, secret codes, logins, passwords to email or accounts). To do this, the user receives a request with a specific service or offer, such as a product with a maximum discount or a message about a win.

With the development of e-commerce, the number of phishing scams is growing every year. To prevent this type of fraud, companies are paying more and more attention to protecting the privacy of their users’ data. Email services and social networks offer to link accounts to IP addresses, mobile phone numbers, or two-factor authentication. Online banks, in turn, use SMS notifications or notifications in the app.

To avoid falling prey to fraudsters, you first need to familiarize yourself with the principle of internet phishing, because when you see a suspicious website or link in an email, you will already be armed with certain information.

How phishing works on the Internet

The main difference between this type of fraud is that, due to their trustfulness or ignorance, users themselves give their personal information to criminals. This can be a fake website with an almost identical domain, an email with a malicious link, pop-up windows with input fields, targeted advertising, etc. The user is asked to register, confirm their personal data, submit an application, enter payment details to purchase goods at a mega discount, etc.

Fraudsters often masquerade as well-known companies by changing or adding a few letters to the domain name or link title to make it seem plausible and confuse inattentive users. Taking advantage of naivety and ignorance, attackers gain access to payment details and steal funds.

The following online phishing schemes are known:

• Sending fake emails. Sending emails asking you to confirm your login and password. Scammers can send a bunch of these emails in a short time using databases they’ve already collected. It’s a bit outdated, though, because email services track and block them.
• Fake emails. To do this, they use emails with a fake “Mail From:” line. A vulnerability in the SMTP email protocol lets attackers intercept emails that the user replies to.
• Online auctions. In this case, goods are sold through a legitimate online auction, but funds are transferred through a fake page.
• Various collections. Charitable organizations, foundations, and other donations.
• Fake online stores. Products are offered at unrealistically high discounts to attract visitors. After placing an order, the user provides their payment details, which are immediately intercepted by fraudsters.

Learning to recognize phishing

The most common cases of phishing are emails or text messages with a message about winning and a request to follow a link to enter your details.

Another way to confuse users is to masquerade as a popular website with an identical design and a similar address. This could be, for example, the website pryvat24 instead of privat24 or mail.gooogle instead of mail.google. Pay attention to the clickable elements in the email; when you hover over a button, you will be able to see the link it leads to.

There is a high probability of seeing phishing links in comments on various websites, forums, pages, or groups on social networks. However, a phishing link may be sent to you on behalf of a friend or acquaintance whose account has been hacked. If the link arouses the slightest suspicion, it is better to refrain from clicking on it.

How to protect yourself from fraud

To avoid falling prey to cybercriminals, it is enough to master a few simple principles of internet literacy:

1. Always be vigilant and question the content of any email you receive.
2. Under no circumstances should you disclose confidential information such as your email/account password, bank card PIN code, or three-digit CVV code on the back of your card via email or telephone. Bank or social network employees will never ask for this information!
3. Pay close attention to messages from your antivirus software and warnings in your browser. They will alert you when you are about to download potentially dangerous files or programs, or when you are about to visit malicious websites.Sometimes websites themselves warn about external links. Email services immediately place emails with suspicious content in the spam folder.
4. If the design and content of the website appear suspicious, contain errors, and are poorly developed, it may be a phishing website.
5. Pay attention to the name of the website in the address bar; suspicious websites often have a domain similar to an existing popular one. Also, do not click on shortened links such as bit.ly.
6. Check for a green padlock next to the website address — this indicates a secure HTTPS connection, which becomes available after an SSL certificate is issued. Click on the icon to view information about the security certificate issued.
7. Read emails from unknown addresses with a cool head. Such emails often play on people’s emotions, using phrases such as “Your account has been hacked!”, “Your profile will be blocked!”, “You have won a prize,” etc.
8. Do not use public Wi-Fi hotspots when logging into your bank accounts. These networks can be used by attackers to intercept data. It is better to use mobile internet or a secure connection for such purposes.
9. If you receive a suspicious email purporting to be from a well-known company or service, please report it to their staff. This will likely help them take action against fraud and protect you and other customers in the future.