What is phishing?
How do phishing attacks work?
In this video, we explain phishing in four increasing levels of difficulty.
Level 1 How do you know if you can trust someone?
All kinds of signs will tell if a person is trustworthy.
For example, police officers or firefighters wear uniforms to show they’re on the job.
A shopkeeper stands in a store behind a counter — letting you know you can trust him with
your money.
He won’t run away after you give him your 5-dollar bill.
He’ll come back with ice cream and change.
Adults who look after you are also trustworthy: parents, teachers, babysitters.
There’s also trust you build over time, by hanging out with friends, for example
But trust works in a different way when you’re on the internet.
Online, you can’t see who you’re talking to.
And sometimes, you’re not even dealing with a person, but with a website or service.
Bad guys can create fake websites or pretend they’re someone you know to make you trust
them.
You can end up handing 5 dollars to someone who’s only pretending to be a shopkeeper
on the internet.
And they will run away with your money.
So when a bad guy fools you into trusting them online, it’s called phishing.
Until you’re old enough to be on the internet on your own, your parents or other trustworthy
people will protect you from phishing.
Level 2 Imagine you have a diary that can be opened
with a password.
You don’t want anyone reading what’s inside, so you use a random string of numbers as a
password.
You come back from school one day, take the diary from its hiding place, and enter the
combination.
And it… won’t open.
You reenter the password a dozen times, but the diary stays locked.
You give up.
The next day, you decide to try again.
You enter the password — and it works — the diary is open!
What happened?
Your younger sister sneaked into your room and swapped your diary with a fake copy.
The fake diary recorded the password you tried to enter.
The next day, while you were at school, your sister switched the diaries back.
And then used the password she extracted through the fake diary to open and read all your secrets.
That little rascal!
That’s phishing, the real-life version.
The internet version is much worse.
Hackers don’t need to live in the same house as you do to steal the password that holds
your secrets.
All they need is to fool you into entering it in a fake login box.
Level 3 You get an email: “ ”
Oh no!
You better CLICK THE LINK.
Ok, so this is obviously a phishing attack.
Follow the link, and you’ll get directed to a fake website.
If you enter your email and password there, you’ll hand them over directly to a scammer.
But not all attacks are so obvious.
Other phishing emails are thoroughly researched and well-done.
Here are the red flags: Most phishing attacks rely on your fear of
missing out.
Look, this sweet deal is available for a very short time!
Scam messages that prey on your fears usually go something like this:
Someone tried to log into your account.
Your password was changed.
Your account will soon be deleted because of suspicious activity.
These messages are standard practice — you’ve probably received a legitimate message that
sounded similar.
That’s why many people will not think twice and click the link.
Businesses are unlikely to send out newsletters, alert emails, or other messages with attachments
— they have no reason to do so.
Download an attachment only when you are 100% sure it’s not malware.
It just doesn’t look like it came from that sender.
Something is off about the style or contents of the message.
This sender had never sent these kinds of offers before.
Grammar mistakes, strange and different fonts throughout the text, a blurry logo or no logo,
or all caps in random places.
Level 4 Fishing attacks are easy to detect when you
follow a few simple rules.
If the email came from a trusted source, you don’t need to worry about phishing, right?
Wrong.
Email accounts can be compromised.
A legitimate email address is no guarantee that the email contents are legitimate.
But what about HTTPS websites?
They encrypt your traffic, so they can’t be scam websites!
Wrong again.
HTTPS means your conversation with the website is private.
But, as writer Scott Hanselman said, “you may be having a private conversation with
Satan.”
Around 83% of phishing sites are HTTPS websites.
If you enter a website, see a padlock, and feel safe — that’s what hackers expect
you to feel: a false sense of security.
So let's say a hacker is conducting one of the more advanced attacks against you — spear
phishing.
These attacks are researched, tailored, and targeted.
The attacker checked your social media accounts, delved into data breaches, and perused any
other online public knowledge.
This hacker now knows your name, where you work, and your work email address.
He sends you an email while pretending to be your colleague.
It says:
“Hey there, John!
I’m Steve, I’ve joined OnlineBest quite recently.
I’m responsible for implementing new tools, which will hopefully help us optimize the
workflow and make our lives easier ;).
Could you please fill out the form below?
Your feedback will help us a lot!
Log in with your username and password, thanks!”
Scary, isn’t it?
That’s why you should be vigilant when reading any email or browsing any website.
In addition, use NordVPN’s Threat Protection feature, which blocks known phishing websites.
Until next time!
Hit “subscribe” for more cybersecurity videos.
Liked our video?
Make sure to check out this one.