Find out how to avoid falling into phising

Phishing: a click makes the difference

Informatics Cybersecurity Internet

What is phishing?

Phishing consists of sending messages, either via email, SMS (named smishing), instant messaging or even social networks, in which cybercriminals mimic the identity of a known organisation to gain access to our most confidential information (passwords, bank details...) by encouraging you to click on a link that redirects you to a fake page.

Emails often include a link that leads the user to counterfeit websites. Once there, personal information is requested from the user and, believing the website is trustworthy, they provide it, falling into the hands of scammers (or phishers).

Phishing can also take place on web pages through advertising banners that encourage you to download an antivirus or any other program by filling in a form that requests personal data.

Phishing attacks are increasingly sophisticated and convincing and confuses users to compromise their own security. The worst thing about these cyber-attacks is that most of the time they infect your terminal — whether mobile or computer — without you noticing.

These cybercriminals use many excuses to capture our attention and redirect us to fraudulent websites that pretend to be legitimate: urgent updates, packages that you have not requested but need to collect as soon as possible, notices of a last payment, the bank asking you to change your password and so on...

But we can fight these cyberattacks. Monitoring a website or using a good antivirus are some of the most effective ways to win the battle against phishing. If you notice that a web page is fake — this happens when it doesn't start with https:// or doesn't have a closed padlock in the browser bar — our recommendation is to clear the browser's cache memory. This will allow you to remove any unwanted software.

History and evolution of phishing

The techniques and targets of phishing have evolved throughout its history. In the 1970s, its most important precedent emerged: a subculture around attacks via the telephone system. These early hackers were known as phreaks, a combination of the words "phone" and "freak". At a time when there were not many networked computers, phreaking became the first technique for defrauding users.

The creation of the term phishing was attributed to a well-known hacker in the mid-1990s, Khan C Smith. At the time, America Online (AOL) was the leading provider of internet access and hackers and hackers used it to carry out phishing attacks against users. Even when AOL adopted security measures, attackers resorted to other techniques such as posing as AOL employees to ask users to verify their accounts and provide billing information.

In the 2000s, cybercriminals developed a well-defined phishing strategy: they posed as a well-known global brand and targeted email addresses on a large scale. Any subject matter was valid to scam victims: bank account closure notices, charity campaigns, prizes... The aim was to usurp the identity of well-known, everyday brands in order to get their hands on victims' information and money. Phishing progressively turned its attention to exploiting online banking payment systems and social networks became an easy target for identity theft because of all the personal data registered on them.

In response to the security measures implemented over time and a certain maturity of the public towards the threat, phishing campaigns have become increasingly sophisticated. A scenario in which cybersecurity providers continue to innovate to respond to new challenges.