Types of phishing: tips for preventing, identifying, and reporting fraudulent emails

The common types of phishing include email phishing, SMS phishing, voice phishing, and QR code phishing. To protect oneself from infringement, one can set a unique password and remain vigilant against unauthorized communication.

Phishing is essentially an attack carried out by cybercriminals using social engineering. Social engineering is the art of manipulating people to leak information or do things they wouldn't normally do in order to steal information. Phishing is one of the most successful social engineering attack methods used by cybercriminals because it is indeed effective. Fraudsters impersonate legitimate companies or individuals through email, text messages, or phone calls, enticing people to disclose sensitive information such as usernames, passwords, credit card details, and other banking and payment information. You can imagine how fishermen use bait to catch fish: in this example, personal information is the fish, scammers are the fishermen, and bait is the scam email they send you. For example, an email may ask you to click on a link and update information.

Junk emails and phishing emails are not the same. Junk mail refers to someone sending emails to multiple users at once, or attempting to market by promoting products to users, which is usually not successful. It can be imagined as annoying spam, but the sender did not intentionally steal your information. This is completely different from phishing attacks with malicious purposes.

Security expert Dion said that there are many types of phishing that need to be guarded against. Email phishing is the most common type where attackers send fraudulent emails that appear to come from legitimate sources, attempting to trick recipients into revealing personal information or clicking on malicious links or attachments. SMS phishing refers to sending SMS messages that lure recipients into leaking personal information or downloading malicious software, which may be disguised as coming from a bank or courier company. Voice phishing uses phone calls to impersonate legitimate institutions, such as banks or technical support, to obtain sensitive information from victims. QR code phishing uses QR codes to take victims to fake websites, which may require victims to provide credentials or download malicious software. In website phishing, attackers create fake websites that are highly similar to legitimate websites in order to steal login credentials and sensitive data. Users are usually directed to these websites through phishing emails or advertisements. Social media phishing refers to the use of social media platforms to send messages or posts, enticing users to provide personal information or click on malicious links. Business email fraud is a complex phishing tactic that targets companies, impersonates executives or suppliers, and authorizes fraudulent transactions or data transfers. In search engine phishing, attackers use search engine optimization techniques to place malicious links at the top of search results, guiding unsuspecting users to visit phishing websites. Sponsorship links can also be malicious links, so extra caution should be taken.

In a typical example of phishing, when cybercriminals attempt to steal usernames and passwords, they send a warning email informing the recipient that their account has been hacked and their password must be reset. The email will contain a link to a website that can help users reset their passwords, but this website is fake. After clicking the link, the user will be taken to a fake website disguised as the company's official website and asked to enter their existing username and password to create a new account. For example, if you have an account with Bank of America, the BOA logo will appear in phishing emails, and the page pointed to by the link will also look like BOA's login page. Entering bank account information will directly send them to cybercriminals. After entering information on a fake website, the website will not have any response, and most users will consider it an invalid link without any questions. But in reality, cybercriminals have already obtained the username and password of the bank account.

Artificial intelligence has caused some worrying new trends in phishing. Artificial intelligence has completely changed the means of phishing and threat actors stealing identity information, especially the deep forgery techniques they can now use. Deep forgery technology can realistically mimic real people, usually using artificial intelligence to generate videos and speech. Due to the fact that deepfake technology can impersonate real people in your life, it is particularly difficult to distinguish authenticity. According to Forbes, in a 2024 incident, a deepfake phishing scam impersonating a CEO successfully defrauded $25 million after an uninformed employee authorized the transaction. With the continuous innovation of fraud methods, security awareness may be more important than ever before. As the threat situation continues to evolve, it is crucial to closely monitor current events and developments. During this process, you may even discover your passion for cybersecurity.

At first glance, it is easy to overlook email phishing attacks when identifying phishing emails. The warning signs to be aware of include: although artificial intelligence can help cybercriminals write more professional emails, spelling errors or emails with forged display names are still common; Language that attempts to create a sense of urgency; The website and email address do not appear to be authentic; And require you to confirm personal information. Other signs to be aware of include links and attachments in emails, unusual requests such as transferring overdue payments, and proactively offered part-time or remote work opportunities. Another technique for identifying phishing emails is to slow down the reading speed. Suggest taking some time and thinking about the following question: Do you know who the sender is? Are you waiting for the sender's email? Is the tone of the email urgent? Will it tell you if you missed the payment or if someone has compromised your account? Cybercriminals may send a message to multiple people at the same time, and the sending time may be strange. If the information appears unusual or suspicious, please check the time of receipt, the number of people copied, and whether you know anyone copied it. You may also receive phishing emails from acquaintances. If you receive unusual emails from family or friends, please verify the authenticity of the email through other channels. You can call or send a text message to the original sender to confirm if they actually sent this message. If the information comes suddenly or does not match the sender's style, do not easily believe that it is safe. Due to the emergence of deepfake technology, this suggestion even applies to video and voice information.

Most phishing emails are relatively safe to open as long as there is no interaction. Be sure not to click on links or open or preview any attachments. If you click on a phishing link, you may face potential risks such as computer worms, keyloggers, malware, ransomware, and spyware. If you open a phishing email and click on a link or attachment, you can take some measures to protect your information. According to the suggestion, all tabs and browsers should be closed immediately. Next, check if any automatic download programs have started and delete them. Suggest changing the username and password. Please change your username and password immediately to prevent unauthorized access to your account. If the same password is used in multiple accounts, be sure to change the password for all accounts. It is recommended to consider using a password manager, which can help you create and manage usernames and passwords. In addition, the password manager can also create strong passwords for you, further enhancing security. For greater peace of mind, you can consider installing antivirus or anti malware software that can scan and remove potential threats from your device. If you encounter a phishing attack on your work device, please be sure to notify the corresponding contact person in your organization in order to follow company regulations and subsequent steps.

Phishing fraud can cause losses to both businesses and individuals. Therefore, understanding how to prevent phishing attacks is crucial. Suggestions for protecting oneself include using strong passwords for each network identity and ensuring that the passwords are unique. Do not use the same password in multiple network identities. Choose different combinations of letters, numbers, and symbols, and avoid using any personal information that others can publicly query, such as date of birth or pet name. Do not click on links in emails. For example, if you receive a notification from the bank, please log in directly to the bank website instead of using the link in the email. Do not share personal or financial information in emails. Be alert to emails, text messages, and phone calls that are actively sent. If it sounds' unbelievably good ', it's likely a scam, such as a work from home job. Do not scan the QR code unless you know its source. You can also use antivirus software, email filtering, and firewalls to reduce phishing traffic.

Job seeking scam emails are a type of phishing email that can affect people looking for jobs, especially college students. These emails usually have only one purpose: to obtain information. They lure you into providing personal information to cybercriminals impersonating potential employers. One way to protect oneself is to understand the position one is applying for and pay attention to the sender of the email. Never reply to unsolicited job search emails.