Glossary term
Phishing
Subject: Financial Crime, Fraud
Also known as: Vishing, Smishing
Phishing is a deceptive message, by email, phone call or text, that poses as a trusted sender to trick people into revealing information, installing malware or making a payment.
Explanation
The attacker copies the look and tone of a bank, courier, employer or government body and creates urgency: an account will be closed, a parcel is held or a tax refund is due. A link leads to a fake site that captures passwords and codes, or an attachment installs malicious software. Variants are named by the channel. Vishing uses voice calls, often with a caller pretending to be bank staff. Smishing uses text messages. Spear phishing is aimed at a named person or role with researched detail. The scams succeed because they exploit human trust rather than technical flaws. Defences include email filtering, multi-factor authentication, warnings on unfamiliar senders, staff training and simulated attacks. One clicked link can hand an attacker the credentials for a payroll system, a mailbox or a customer's online banking.
Example
An employee receives a text claiming a parcel could not be delivered and asking him to pay a small fee through a link. The page asks for his card number and a one-time code from his bank. Moments later a call comes from someone saying they are the bank's fraud team and urging him to move money to a safe account. Both the text and the call belong to the same scam.
Not to be confused with
- Business Email Compromise (BEC)
- BEC is a targeted impersonation aimed at a payment decision. Phishing is the wider tactic of luring people into giving up data or money.