What Is Phishing?

Phishing attacks explained

Phishing is one of the oldest forms of email attack, but it’s still prevalent in organizations of all sizes. It happens when fraudsters spam users online with emails. These emails sometimes promise prizes or threaten an account suspension, for example, then ask them to click on a link or go to a site to sort things out. Instead of winning a gift or reactivating that frozen credit card, users instead get their identities stolen or their computers infected with viruses.

How do phishing attacks work?

Phishing scams rely on tricking users into taking action — for example, in URL phishing, hackers want users to access a fake website and divulge passwords and sensitive information. The site often asks the user to reset a password, reenter personal and credit information to validate an account, or download a “software update,” which is really malware in disguise.

Phishing attacks are becoming more sophisticated

Threats to enterprise security are constantly evolving and growing in complexity, and phishing threats are no exception.

In a phishing email, attackers masquerade as a reputable entity or a known person to dupe users into sharing important information like login credentials or account information. In a spear phishing email, attackers often pose as an individual within the recipient’s company, while the sender of a whale phishing email might impersonate the CEO or CFO and instruct the recipient to transfer money to a fraudulent account.

These kinds of phishing threats have been enormously successful. In fact, 91% of all hacking attacks today began with a phishing or spear phishing email. With each breach potentially costing millions in damage to business, productivity and reputation, organizations need sophisticated protection to guard against these ever-evolving attacks.

Examples of phishing emails

Phishing emails can take many forms, but all share one goal: to deceive the unsuspecting user into revealing account credentials, contact information, or other sensitive data. These emails often contain a malicious link or malicious attachment, disguised to look legitimate.

Here are common examples:

• An email pretending to be from your bank, warning of suspicious activity and prompting you to click a link to "verify your account." The link leads to a fake site designed to steal your account credentials.
• A message that looks like it's from your company's IT team, asking you to download a "critical update" — which turns out to be a malicious attachment loaded with malware.
• A seemingly friendly email from a colleague asking you to review an attached document, which is actually part of a phishing scam launched by cyber criminals.

Each of these emails is crafted to look real, often using logos, names, or even previous email thread formats to make it more convincing.