A phishing attack is an example of a social engineering attack where hackers deceive an individual into providing them with information or installing malware into their devices. Hackers that use social engineering attacks don’t hack into devices in the technical sense and instead target the emotions and behavior of an individual. Therefore, it is always more challenging to defend against such attacks, which could explain why phishing traces to as far back as the early 1990s and is still being used. Of course, to adequately protect yourself against such attacks, you need to understand how they are executed and the methods available to prevent them.

Defending against phishing attacks

Email phishing

Email phishing refers to sending spoofed emails with an aim to receive confidential information from the recipient. For instance, the email could claim to be from your bank, asking you to click on a link and update your financial details. Spoofed emails are one of the primary reasons why email phishing works out so well. Spoofed emails are fraudulent emails that are made to resemble an original down to the logos and sender addresses. Hackers can use spoofed emails to convey their message to their intended targets, thereby making them click on a link that redirects to a spoofed website or to download attached malware.

The crux of the problem is that it is difficult to verify the authenticity of the sender. Even when the sender address claims to be correct, you should still be skeptical — the best way to authenticate the identity of the email sender by using PGP. Unfortunately, not many organizations and individuals use PGP. You should also ensure that you don’t have the habit of clicking links in emails or downloading any attachments without verification of the sender’s identity.

Website phishing

Website phishing refers to using spoofed sites to steal an individual’s information. Spoofed sites are clones of real websites, and the success of a website phishing scam depends on how well a cloned website resembles the original. An example is the Equifax website phishing scam.

Again, the problem lies with the authentication of the website. However, it is easier to verify the authenticity of a website than it is for an email. You should confirm that the URL is correct — typos in the URL means that the site is fake. Second, if you have a password manager (and you should), it should register the account on the site and autofill your login credentials, and if it doesn’t, you should report the website. Other issues you should look out for when on cloned sites include too many popups, poor web design, and misspellings. To avoid getting caught up in website phishing scams, you should bookmark relevant sites.

Telephone phishing

Telephone phishing refers to where the hacker calls or texts the target aiming to steal information from the target. For instance, a hacker might impersonate a bank official to request you send your credit card details. Unless the caller is someone you know well, it is almost impossible to verify their identity. Besides, there are various ways of hiding the caller ID. To protect yourself against telephone phishing, you should never offer up any personal or confidential information to an unknown caller. Organizations don’t ask for sensitive information via call or text, and if you ever receive such a call or text, you should hang up then call back using the publicly listed number to confirm or report the telephone phishing.

 

The Takeaway

You should never share your information on phones, web, or email unless you are certain that the recipient of the information is legit. Calls, texts, sites, and emails that pressure you to offer up sensitive information are almost always phishing scams, and you should avoid and report them. Antivirus software, password managers, and bookmarks are some of the ways to defend against phishing. Moreover, you should strive to gain as much information on phishing as possible to increase your security.