FAQs: All things phishing

Phishing is a cyberattack where criminals attempt to deceive individuals into sharing sensitive information, such as passwords, credit card details, or personal identification information. These cyberattacks are often conducted through fraudulent emails, text messages, or websites.

Many organizations still have employees fall for phishing emails. According to CISA, 8 out of 10 organizations had at least one employee fall victim to a phishing attempt by the CISA Assessment team. Here are some FAQs that can help employees better understand phishing attacks. 

How does phishing work?

Phishing typically involves:

• Bait: A message or link that appears legitimate but contains malicious intent.
• Hook: A message encouraging the victim to click on the link or provide sensitive information.
• Catch: Using the stolen data to commit fraud, identity theft, or other crimes.

What are the common types of phishing?

• Email phishing: Sending fake emails that mimic legitimate organizations.
• Spear phishing: Targeting specific individuals or organizations with tailored messages.
• Smishing: Sending phishing attempts via text messages (SMS).
• Vishing: Conducting phishing through voice calls.
• Pharming: Redirecting users to fraudulent websites without their knowledge.

How can I identify a phishing attempt?

Look for the following signs:

• Urgent or threatening language ("Act now or your account will be locked!")
• Requests for sensitive information (passwords, PINs, or SSNs).
• Suspicious sender email addresses or phone numbers.
• Spelling and grammatical errors in the message.
• Links that don't match the official website (hover over links to verify).

Go deeper: Tips to spot phishing emails disguised as healthcare communication

Why do phishing attacks work?

Phishing attacks are effective because they exploit trust, urgency, and human error. Attackers craft realistic-looking messages and leverage emotional triggers to prompt quick action.

Read also: Why people still fall for phishing attacks in 2024

Can phishing target mobile devices?

Yes, phishing attacks can target mobile devices via SMS (smishing), malicious apps, or fake websites accessed through mobile browsers.

What should I do if I suspect phishing?

• Do not click on links or download attachments from untrusted sources.
• Verify the sender by contacting the organization directly using official contact information.
• Report the phishing attempt to your IT department (for organizations) or relevant authorities (e.g., FTC, local cybercrime units).
• Delete the phishing email or message after reporting.

What should I do if I’ve fallen for phishing?

• Change your passwords immediately, especially for affected accounts.
• Enable two-factor authentication (2FA) for added security.
• Monitor your accounts for unauthorized activity.
• Report the incident to your bank, credit card company, or relevant authority.
• Run antivirus software to check for malware.

How can I protect myself from phishing?

• Be cautious with unsolicited emails or messages.
• Enable 2FA on all sensitive accounts.
• Regularly update your software and security patches.
• Use strong, unique passwords for different accounts.
• Install and update antivirus software.

Why is phishing dangerous?

Phishing can have severe consequences, including identity theft, financial loss, compromised business data, and malware infections like ransomware.

Who are the common targets of phishing?

Anyone can be a target, but common victims include:

• Individuals unfamiliar with cyber threats.
• Employees in organizations with access to sensitive data.
• Online shoppers and frequent internet users.

See also: HIPAA Compliant Email: The Definitive Guide