What is phishing?

Phishing: definition and variants

The term is modeled on “password” and “fishing”: attackers cast the bait and wait to see who bites. A typical case is an email that supposedly comes from a bank, a parcel service, Microsoft or management and pushes for quick action: confirm a password, open an invoice, approve a payment.

Besides mass-mailed messages, there are targeted forms. In spear phishing, the message is tailored to a specific person or company. In CEO fraud, a form of business email compromise, the perpetrator poses as the boss or a supplier and demands a transfer. Add to that smishing by text message, vishing by phone and quishing with fake QR codes.

How a phishing attack unfolds

The perpetrators research names, roles and business partners, often from the website, the legal notice or social networks. Then they send a convincing message with a link to a replica sign-in page or with a booby-trapped attachment. Anyone who enters data or opens the attachment hands over credentials or installs malware. With stolen accounts, the perpetrators go further, for example with forwarding rules in the mailbox through which they can read business correspondence and intervene at the right moment.

• Urgency, threats or an unusual request (“pay today”)
• Sender address deviates slightly from the original or uses a foreign domain
• The link target does not match the displayed text (hover the mouse pointer over it)
• Unexpected attachments, especially Office documents with macros, archives or HTML files
• Changed bank details without confirmation through a second channel

Real-world example: the changed bank account

A construction company receives an email from its regular supplier: the bank details have changed, and future invoices should be paid to the new account. Sender, logo and tone are right, because the supplier’s mailbox had indeed been hijacked beforehand. Without a check, the next five-figure payment would go to the perpetrators.

The company has a simple rule: bank details are only changed after a call-back to the known phone number, never via the number in the email. In addition, the four-eyes principle applies to new payees. Accounting calls back, the fraud comes to light, and the supplier can secure its mailbox.

Protection in the company and imple­menta­tion

Technology and behavior belong together. On the technical side, email filters, sender authentication with SPF, DKIM and DMARC, two-factor sign-in and managed devices help. People need short, regular training and an easy way to report suspicious messages—without fear of blame. Anyone who has fallen for it changes the password immediately, ends sessions and informs IT; where personal data is involved, reporting obligations must be examined.

Nano Concepts sets up sender authentication and filters for your domain, enables two-factor sign-in, trains teams practically using realistic examples and supports the response to security incidents, from containment to follow-up. The aim is that suspicious messages are reported quickly rather than silently deleted.