Some people (and companies), never learn, so not only is\nphishing the most successful attack method to date, it takes hackers zero\neffort to get it done. Sure, there are different types of phishing, some more\nsophisticated than others and with different motivations, but they all rely on\npsychological manipulation. <\/p>\n\n\n\n
Phishing has been the preferred method of countless criminals\nbecause it\u2019s incredibly easy to deploy, yet very effective in gaining\nunauthorized access to critical information. While some may feel confident that\ntheir firewall will keep them safe, phishing actually gets past traditional\nsecurity solutions because social engineering enables cybercriminals to\nmanipulate their victims into revealing sensitive information about themselves\nor their organizations, including their credentials.<\/p>\n\n\n\n
It doesn\u2019t take a genius to launch a phishing attack.\nPhishing kits can easily be bought online and used to spoof websites or collect\ndevice information (in addition to the typical personal information). The most\ncommon kits will spoof email providers or file storage services. Some scammers\nwill just use social media to pose as customer support to steal financial\ninformation. <\/p>\n\n\n\n
How Do Different Types of Phishing Work?<\/h2>\n\n\n\n
The answer to this question depends on the type of phishing you\u2019re talking about specifically. It\u2019s good to keep an eye on what\u2019s in your inbox because scammers are continually improving their skills and tactics. Phishing has evolved from the traditional campaigns most are probably familiar with, and, unfortunately, they\u2019re getting harder to detect even for the most tech-savvy individuals. Just recently, fraudsters sent out a smishing scam impersonating Verizon Wireless asking users to verify account security<\/a>. <\/p>\n\n\n\n A phishing attack will always try to manipulate you into\ntaking an action or revealing critical information. The goal for cybercriminals\nis to trigger an emotional or inquisitive reaction out of their victims. For\nexample, they\u2019ll use urgent or emotionally charged language to get you to\nengage with their email in some way. <\/p>\n\n\n\n Some examples of conventional phishing emails include: <\/p>\n\n\n\n Phishing is a social engineering scheme that uses different types of email attacks, malicious websites or apps, text messages and even phone calls to psychologically manipulate a user into revealing personal information or critical data about the organization. Unless the accounting department is hit \u2014 then a ridiculously high money transfer will likely make its way into a bank account on some paradise island! <\/p>\n\n\n\n Some of the most popular types of phishing attacks are spear phishing, vishing, smishing<\/a>, whaling, HTTPS phishing and business email compromise (BEC). Many types of phishing attacks are launched to spread ransomware, which is malicious software that encrypts your data and will hold it hostage until you pay a ransom in cryptocurrency. <\/p>\n\n\n\n Let\u2019s explore five of the most common types of phishing\nattacks:<\/p>\n\n\n\n With HTTPS (Hypertext Transfer Protocol Secure) phishing<\/strong>, hackers have figured out a way to trick users into believing that a website is legitimate. They will rely on users\u2019 misconceptions that the page is encrypted and secure simply because it displays HTTPS and the green padlock symbol. But today, even phishing websites can use the HTTPS protocol<\/a><\/strong> (i.e. incorporate website certificates) in the browser address bar to win user trust. The user will then easily fill out a form, for example, and give away their credentials or other sensitive information. <\/p>\n\n\n\n Last year, the FBI warned users<\/a> that just because a website starts with HTTPS, it doesn\u2019t mean it guarantees privacy and security. The FBI recommends being suspicious of unknown senders, especially if their email address ends in .com when it should be .gov, and looking out for misspelled words. Cybersecurity company Trend Micro reported<\/a> last year that the types of phishing using digital certificates to encrypt connections spiked to 58% in Q1 of 2019, and they are on the rise. A Q3 2019 report<\/a> from the Anti-Phishing Working Group (APWG) estimates that the number is actually higher \u2014 68%! <\/p>\n\n\n\n Business Email Compromise<\/strong>, also known as email\naccount compromise (EAC) is a type of phishing attack in which a cybercriminal\nimpersonates corporate executive management to trick employees (typically in\neither Human Resources or accounting) into authorizing a wire transfer payment,\nor sharing personally identifiable information (PII) or tax information. <\/p>\n\n\n\n The FBI has reported that BEC scams represented half of the 467,361 cybercrime losses reported in 2019<\/a>, accounting for $1.77 billion. Other FBI statistics<\/a> report a high number of complaints regarding spoofed emails, which impersonate an employee asking for direct deposit account changes, with a lot of the funds primarily heading to banks in China and Hong Kong, as well as the United Kingdom, Mexico and Turkey.<\/p>\n\n\n\n In order to appear legitimate and steal employee credentials, these types of phishing attacks that involve a payroll diversion scheme may include a spoofed login page for an email host. According to victim complaints received by the FBI between June 2016 and July 2019, the domestic and international exposed dollar loss exceeded $26 billion. In 2019, Facebook and Google were defrauded<\/a> of over $100 million in a sophisticated scheme.<\/p>\n\n\n\n Spear phishing attacks<\/strong> are not your average scam.\nThese are targeted types of phishing, tailored and researched to appear\ngenuine. Technology and social media have been of great help in victim research\nto devise personalized and compelling email attacks. <\/p>\n\n\n\n As many as 91% of cyberattacks<\/a> start with a spear phishing email, and they are often successful in manipulating key employees in an organization\u2019s HR, finance, legal or IT departments to share their credentials or click on a link that will download malware into the system. The email could appear as a LinkedIn notification, an urgent request from a team member or a manager, or even an urgent email from an institution. Top companies such as JP Morgan, Home Depot, and Target<\/a> have been breached following spear phishing attacks.<\/p>\n\n\n\n Whaling attacks<\/strong> are similar to spear phishing attacks,\nonly they are more specific and target c-level executives or high-ranking individuals\nwith authority who have access to critical information or even wealth. Because\nwhaling emails involve extensive research to deceive the victim into believing\nthe message is legitimate, criminals engaging in these types of phishing\nattacks can be very patient in achieving their financial gain. Whaling emails\nare specific and include very personal details to convince the victim to engage\nwith the call to action. <\/p>\n\n\n\n Vishing <\/strong>is just a fancy term for voice phishing <\/strong>or\nphone fraud.<\/strong> Whenever you get a pre-recorded message from the IRS or from\nyour bank asking you to call a number and give away your credit card\ninformation or Social Security Number, you\u2019re looking at a well-crafted\nphishing attempt. Recently scammers have started combining voice with text\nmessages (smishing<\/strong>) to make the scam appear more legitimate.<\/p>\n\n\n\n Security expert Brian Krebs warned on his blog that voice phishing scams are getting smarter<\/a>. Based on his friend\u2019s experience, he says fake phone calls from credit unions or the tax department have become so sophisticated that the details mentioned by the criminal frequently make sense. The calls appeared made from trustworthy numbers, yet we know by now how easy it is for criminals to spoof the caller ID number.<\/p>\n\n\n\n The list goes on, as there are many other types of phishing\nattacks such as clone phishing, domain spoofing, evil twin, and watering hole\nphishing.<\/p>\n\n\n\n Some 30% of all phishing emails<\/a> are opened by targeted users. Most data breaches have started either from the use of a weak password or from a phishing attack that exploited an employee\u2019s behavior<\/a>. If we take a closer look at statistics, some type of phishing email was behind 78% of cyber espionage episodes<\/a> and more than 95% of attacks in general start with a phishing email. <\/p>\n\n\n\n A phishing attack will go after information such as:<\/p>\n\n\n\n While some types of phishing attacks are financially motivated,\nit\u2019s not always the case. Some phishing is done with the goal of performing\ncyber espionage, while others are politically motivated. <\/p>\n\n\n\n According to Verizon\u2019s 2019 Data Breach Investigation Report (DBIR)<\/a>, 71% of attacks, including phishing attacks, were financially-motivated. Financial gain remains a top motivation \u2014 especially in attacks targeting c-level executives who are more likely to click on urgent emails and have authority to make money transfers, says the report. <\/p>\n\n\n\n Intellectual property and sensitive data are among the top targets for different types of phishing attacks. Nation-state backed cybercriminal gangs are supported by Russia, China, Iran and North Korea. They target Western companies and governments with spear phishing emails to execute malicious payloads and steal critical, proprietary information, according to ZDNet<\/a>. <\/p>\n\n\n\n Just recently, Iran-sponsored hackers targeted government organizations in Turkey, Jordan and Iraq<\/a> with spear phishing attacks to steal intellectual property.<\/p>\n\n\n\n Emails impersonating government authorities have claimed many victims. However, likely the most notorious politically motivated spear phishing attack was launched by Russian-backed hackers against the U.S. Democratic party during the 2016 election to steal information about the Clinton campaign<\/a>. <\/p>\n\n\n\n Regardless of which type of phishing attacks cybercriminals\nuse, it\u2019s imperative that you and your employees know how to recognize them for\nwhat they are.<\/p>\n\n\n\nWhat Are Some of the Main Types of Phishing Attacks?<\/h2>\n\n\n\n
![\"\"](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/03\/types-of-phishing-example.png\")
HTTPS Phishing Attacks<\/h3>\n\n\n\n
![\"Graphic:](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/03\/https-phishing-example.png\")
<\/figure><\/div>\n\n\n\nBusiness Email Compromise Attacks<\/h3>\n\n\n\n
Spear Phishing Attacks<\/h3>\n\n\n\n
Whaling Attacks <\/h3>\n\n\n\n
Voice Phishing<\/h3>\n\n\n\n
Types of Phishing Motivations<\/h3>\n\n\n\n
Financially Motivated Phishing Attacks<\/h4>\n\n\n\n
Cyber Espionage-Motivated Phishing Attacks<\/h4>\n\n\n\n
Politically Motivated Phishing Attacks<\/h4>\n\n\n\n
How to Identify Most Types of Phishing Attacks<\/h2>\n\n\n\n