Despite the name being mildly amusing, phishing attacks are no laughing matter. These scams, in all their different forms, wreak havoc on businesses, successfully impacting 65 percent of United States organizations in 2019 as reported by Proofpoint’s 2020 State of the Phish Report. Avoiding them requires you to be able to spot them, so let’s go over the different varieties of phishing that can be encountered. Here is a field guide to phishing attacks. 

Guide to Phishing Attacks – What is Phishing? 

It is important that we establish what a phishing attack looks like at its essence, as all forms of phishing share a few of these same spot-able traits if you’re looking for it. 

In a phishing attack, a target is sent a message that appears to come from a trustworthy contact to manipulate the target’s response. For example, one of your employees may receive an email that looks like it came from a prospect, a client, or vendor… presumably one that they should open. However, rather than opening the message to a legitimate communication, the email would either deliver malware via a download or send the recipient to a malicious website. To read more into exactly what this looks like, check out our Phishing Case Study. 

Due to this simple basis, phishing can be used as the foundation for various scams, delivered in different ways, and relies on a variety of tactics to take advantage of different targets. Employees have stress throughout the workday due to a variety of factors. Some might worry about their work performance suffering, while others might feel pressured to click on certain attachments because someone tells them that it’s important enough. Some might just not think things through before clicking on unsolicited attachments or links, leading to the gate being opened for hackers. 

Business Email Compromise 

In a business email compromise attack, an attacker will pose as an authority figure to coax users into transferring money into an account under the attacker’s control. By writing this email to suggest urgency, the attacker can effectively scare their target into acting without thinking. These phishing attacks have the potential to be quite lucrative, with the average request in 2020 totaling $80,183. 

Clone Phishing 

Some attackers copycat with their phishing messages, duplicating a legitimate email that their target would likely have gotten before. In doing so, they make their attack appear more convincing. The lone difference—the included link is switched out for one that directs the target to a spoofed website. 

Smishing 

Not all phishing attacks are distributed through email. Nowadays, smishing attacks—those dispersed via SMS—are another common enough tactic used. One of the main reasons that smishing is frequently successful is that people aren’t anticipating being phished through a text message. On top of all that, mobile devices often don’t uphold the same security standards that a workstation will.  

Spear Phishing 

Spear phishing is a phishing attack that goes the extra distance. Rather than targeting a user through a generic message, the cybercriminal will have researched their intended victim. Because these attacks take more time and effort to execute, spear phishing is typically leveraged against higher-value targets.  

Vishing 

Vishing, or voice phishing, is a phishing attack conducted over the telephone. A scammer can extract credentials and other personally identifiable and sensitive data from their target by calling up their target under the guise of a business or a financial institution. This is where you have probably heard about from your grandma as they will target older demographics and try to convince and confuse them over the phone to give up information.  

Whaling 

As the name would suggest, whaling is a phishing attack that targets the biggest person in an organization: the boss. As the head honcho, it stands to reason that the business owner would have the most access to the business’ resources and data, enabling the cybercriminal to steal the greatest possible amount. 

With the amount of background information that these attacks require to be pulled off, it isn’t uncommon for an attacker to do some research through social engineering and the review of publicly accessible information to make their story more believable. 

Ways to Fight Phishing Scams 

If you’re having trouble showcasing the importance of phishing scams, consider the following tips and tricks from Symmetric IT Group: 

• Undergo regular phishing scam training: If you train your employees to identify phishing scams, they will be less likely to fall victim to them in the future. 
• Double-check any suspicious messages: Messages that you think are phishing attacks should be directed to your IT department. 
• Never respond to urgent requests before following up: If you get messages from someone internally urging you to make a wire transfer or do something suspicious, follow up with them in person if possible. 
• Reconsider best practices and workflows: If something seems out of place or suspicious, fall back on best practices to guide you to the best possible outcome. 

Phishing is a Serious Threat 

Spam is a major hindrance when running a business that relies on email, but it’s easy to protect your employee’s time from the average spam messages with the right technological support. While phishing can be largely avoided with the proper diligence, your team will need to know what they are looking for to stop it effectively. Symmetric IT Group can help. Find out what we can do to help keep your business secure by calling 813-749-0895.