By Robert Descôteaux, Manager, System Administrator at ITCloud 

What Is Phishing? 

Phishing is a cyberattack technique that aims to trick a person into obtaining sensitive information, such as logins, passwords or banking data. 

The technique involves sending a deliberately misleading message designed to look as similar as possible to a message that a legitimate sender would send. The most common type of this cyberattack can take several forms, including emails, text messages, social media messages or phone calls. 

In most cases, phishing campaigns are untargeted and target as many people as possible in the hope that a certain number of them will take the bait. 

Phishing can have serious consequences for the data protection and identity of victims. Here are the main impacts: 

Impact on data protection 

• Theft of sensitive data: Attackers can obtain login details, passwords, credit card numbers or other confidential information. 

• Corporate information leaks: In a business setting, a successful phishing attack can expose internal documents, customer data or trade secrets. 

• Malware propagation: Some phishing emails contain infected attachments or links that install malware (ransomware, keyloggers, etc.). 

• Access theft: cybercriminal can use stolen information to access systems, modify data or disrupt operations. 

Impact on identity 

• Usurpation d’identité : Un attaquant peut utiliser les informations personnelles obtenues pour se faire passer pour la victime et commettre des fraudes (ouverture de comptes bancaires, souscription à des crédits, etc.). 

• Atteinte à la réputation : Si un attaquant accède à un compte professionnel ou personnel (réseaux sociaux, messagerie), il peut diffuser des informations compromettantes. 

• Difficulté de récupération des comptes : Une fois un compte compromis, la récupération peut être complexe si les attaquants ont modifié les informations de sécurité. 

How to protect yourself from it? 

The best way to protect yourself? First, make sure you have the right information. To protect yourself from phishing attempts, you need to know the tactics cybercriminals use to trap you. 

• Never click on suspicious links or download unverified attachments. 

• Check the sender and the hyperlink before entering your authentication information. 

• Activate multi-factor authentication (MFA) to secure access. 

• In companies, raise awareness among employees and users about phishing techniques. 

A successful phishing attack can have devastating consequences, both personally and professionally. Vigilance and good cybersecurity practices are essential to limit the risks. 

Detect Phishing 

There is no easy way to protect yourself against a phishing attack. Here are some tips to recognize a phishing attack. 

Information  

The most common tactic used in phishing is that it almost always contains a sense of emergency. Example :  

• Hurry! Your account has been hacked, please change your password. 

• Respond within the next hour and win a trip to Cancun. 

• Urgent! Your BitDefender license expires today, please renew it 

A Message Asks You to Provide your Personal Information 

Every time you receive an email, text message or phone call asking for personal information, alarm bells should go off in your brain. 

Would a legitimate organization use this method to ask for your personal information? 

In most cases, the answer is “no.” 

But it’s not always easy to tell. Cybercriminals have become experts at crafting messages that appear completely legitimate. 

One tactic they use to steal your personal information is to promise something that’s too good to be true, such as a tax refund, a trip, money or prizes. 

Remember the adage: if something is too good to be true, it probably is. If you’re told you’re the winner of a contest you’ve never entered, then you’re the victim of an attempted scam. You can never be too careful. If you are unsure of the origin of a message, call the person or organization that is the alleged sender. Use the organization’s official contact information to do this. If it is your bank, use the phone number listed on the bank’s official website. 

Don’t forget, legitimate organizations will never ask you for your personal information via email or text message. If so, you are likely the victim of a fraud attempt. 

The Threatening Message 

Cybercriminals need to find a way to get their victims to do what they want. A message asking someone to give up their information won’t work if it ends with a simple “please” or “thank you.” That’s why cybercriminals often use threats to get what they want. 

For example, a common phishing scam involves a cybercriminal claiming to be from a government agency and threatening the victim with a hefty fine or even jail time. 

When faced with such a threat, most people will think about the consequences of such a threat if they don’t cooperate. That’s why this type of phishing scam is so common. 

If you receive a threatening message, stop and think instead of panicking. The sender of the message is most likely a cybercriminal trying to scare you into getting what they want. 

The Suspicious Message 

Phishing scams can be tricky to spot. Cybercriminals are experts at crafting messages that look like they’re coming from a trusted person or organization. 

For example, phishing emails often come from an address that has nothing to do with the person or organization the sender claims to be from. 

For phone or text message scams, a quick internet search of the sender’s phone number can help you determine whether the message is legitimate 

The Message Contains a Suspicious Link 

Tricking people into clicking on a link is a tactic that cybercriminals have long used. 

Typically, they send you an email that includes a link that they ask you to click on. This link leads to a fake website that closely mimics that of a legitimate organization, with the goal of stealing your personal information. This type of attempt can take many forms (cybercriminals have a fertile imagination). Their common denominator is to get you to click on the link. 

However, there are some clues to recognize this type of message: 

• The hyperlink in the email does not match the hyperlink on the website of the organization the sender claims to represent. 

• Scanning the link will reveal the hyperlink to which they are trying to send you. So check the hyperlink to make sure it matches the address of the legitimate organization the sender claims to represent. 

If There is Something Wrong with the Message 

Phishing messages often contain grammatical errors or overuse punctuation marks such as exclamation points. Sometimes, the graphics are poor or the logo is poorly designed. Legitimate businesses and government agencies would never send such a message. If something like this is present, it is likely a phishing attempt. 

The different types of phishing 

Here’s an overview of the most common types of phishing used by cybercriminals to steal your personal information. 

• Classic phishing: mass fraudulent messages aimed at a large audience. 

• Spear phishing: targeted attacks against a specific person or company. 

• Whaling: targeting executives or managers to gain critical access. 

• Vishing (voice phishing): phishing via telephone call. 

• Smishing (SMS phishing): scam via SMS encouraging you to click on a fraudulent link. 

Here’s a more detailed description of the different types of phishing: 

Classic phishing 

Le phishing classique consiste à envoyer un grand nombre de messages frauduleux (courriel, SMS, messages sur les réseaux sociaux) dans l’espoir que certaines victimes mordent à l’hameçon. 

• Goal: Steal personal information (logins, passwords, bank details). 

• Method: The attacker imitates a legitimate company or institution (bank, government, service provider) and asks the victim to perform an urgent action, such as clicking on a link or downloading an attachment. 

• Example: An email claims to be from PayPal informing you of a “problem with your account” and asking you to log in via a fraudulent link. 

Spear phishing 

Spear phishing is a more sophisticated and targeted attack. Unlike traditional phishing, the attacker takes the time to research specific information about his victim before launching his attack. 

Goal: Deceive a specific person to gain access to sensitive data. 

Method: The attacker personalizes the message using credible details (name, position, colleagues) to gain the victim’s trust. 

Example: An employee receives an email apparently sent by his superior, asking him to download a confidential document or update his password. 

Whaling 

Whaling is a form of spear phishing that targets influential people (CEOs, CFOs, senior executives). These individuals often have privileged access to critical information. 

• Goal: Obtain funds, access to databases or trade secrets. 

• Method: The attacker sends highly sophisticated emails, imitating high-level professional communications. 

• Example: A CEO receives a fraudulent email supposedly from his financial partner, asking him to make an urgent bank transfer. 

Vishing (Voice phishing) 

Vishing is a phishing technique carried out by telephone. The attacker claims to be an official service in order to extort confidential information. 

• Goal: Recover personal or banking data or access to an account. 

• Method: The attacker uses persuasion techniques and plays on emergency or fear. 

• Example: A fake bank advisor calls a customer to report “suspicious activity” on their account and asks them to provide their login details. 

Smishing (SMS phishing) 

Smishing is a phishing attack carried out via SMS. Cybercriminals send messages encouraging the victim to click on a malicious link. 

• Goal: Steal credentials or infect the phone with malware. 

• Method: The attacker sends a legitimate-looking SMS, often accompanied by a fraudulent link. 

• Example: An SMS claiming to come from the post office informs you of a pending package and invites you to click on a link to pay fictitious delivery costs. 

Vishing and Voice Artificial Intelligence 

I cannot ignore the voice artificial intelligence in this publication. 

With the emergence of voice AI, it allows cybercriminals to create automated calls that appear to come from legitimate sources, such as financial institutions, businesses, or even relatives. 

Artificial intelligence, especially increasingly realistic text-to-speech technologies, allows cybercriminals to create automated calls that appear to come from legitimate sources, such as financial institutions, businesses, or even relatives. 

AI software can reproduce human voices with a high degree of realism, making it harder for the person receiving the call to distinguish a genuine call from a fraudulent call. For example, scammers can use AI-generated voices to imitate business executives, family members, or bank officials, making the attack more credible. 

The use of AI in this context also allows for the automation of these attacks on a large scale, making their detection and prevention even more complex. Voice recognition technologies can also be used to capture specific responses to certain questions, reinforcing the effectiveness of fraud. 

It is therefore essential to be vigilant about suspicious calls and to always verify the identity of the person on the other end of the line, especially if you are asked for sensitive information. 

Conclusion 

There is no absolute surefire way to protect yourself from phishing. But there are some tactics that can help protect you. The most effective? Common sense. If we are vigilant and attentive to anything that may seem suspicious, we will be able to recognize a phishing attack. And remember, training and educating your customers is easier than having to deal with a data breach once it has occurred. 

You want to know more?
Fill out this form and one of our security specialists will contact you shortly.