Phishing Attacks - How to Recognize and Avoid Them

About 2 min read

Phishing is a cyberattack technique that uses fake websites and emails impersonating legitimate services or companies to trick users into revealing their passwords, credit card numbers, and personal information. The word is a blend of "fishing" and "sophisticated," reflecting how attackers "fish" for users with cleverly crafted lures. According to the FBI's 2024 report, phishing tops the list of cybercrime victim counts every year, and the rise of attacks abusing generative AI has been flagged as a new threat.

Historical Background

The origins of phishing trace back to AOL (America Online) in the mid-1990s. The technique of attackers impersonating AOL staff to extract users' passwords is regarded as one of the earliest cases. In the 2000s, phishing targeting online banking surged, and from the 2010s onward, attacks aimed at cloud services and social media accounts became mainstream. In recent years, abusing generative AI has made it easy to create grammatically flawless phishing emails, rendering the traditional method of spotting "unnatural language" ineffective.

Types of Phishing and Comparison

Ordinary phishing targets the general public indiscriminately, but more advanced variants also exist. Spear phishing is a targeted attack aimed at a specific individual or organization, sending highly credible emails after researching the recipient's information in advance. Whaling is a form of spear phishing that targets executives (such as the CEO or CFO), deriving its name from going after the "whale." Smishing is phishing conducted via SMS, and vishing is a technique using phone calls. The precision of the attack and the financial damage tend to increase in the order of ordinary phishing → spear phishing → whaling.

The fundamentals of phishing defense can be learned systematically from cybersecurity defense books on Amazon.

Real-World Use Cases

"At this morning's CSIRT meeting, three phishing emails targeting the accounting department were reported. The sender domain differed from the legitimate one by a single character, and malware disguised as an invoice PDF was attached."

Attack Flow

How to Spot Phishing

To spot a phishing email, it is important to check the domain of the sender's address. Addresses that subtly differ from the legitimate domain (for example, amaz0n.com) are often used. In addition, wording that creates a sense of urgency, such as "your account will be suspended" or "respond within 24 hours," is a typical hallmark of phishing. Always check the destination URL before clicking and make sure it is the legitimate domain.

Countermeasures and Pitfalls in Practice

A common misconception at security sites is the overconfidence of "I won't be fooled." According to research on social engineering, it is not uncommon even for security experts to fall for cleverly crafted phishing. Within organizations, regular simulated phishing drills are effective; companies that conduct such drills are said to reduce click rates by an average of more than 60%. By using a different, random password for each service, even if you fall victim to phishing on one service, you can prevent the damage from spreading to other services. Setting up two-factor authentication is also an effective countermeasure.information security literacy books (Amazon) are also helpful for strengthening your everyday defenses.