Phishing Attacks - How to Recognize and Avoid Them

About 2 min read

Phishing is a cyberattack technique that uses fake websites and emails impersonating legitimate services or companies to trick users into revealing their passwords, credit card numbers, and personal information. The word is an alteration of "fishing," and the "ph" spelling is explained as reflecting a 1990s hacker-culture habit of swapping "f" for "ph" (as in phreaking). In the 2024 annual report published by the FBI's IC3 (Internet Crime Complaint Center), phishing and spoofing drew 193,407 complaints, the highest of any crime type. The same report also records that a warning about criminals using generative AI to facilitate financial fraud was issued in December 2024.

Historical Background

The origins of phishing trace back to AOL (America Online) in the mid-1990s. The technique of attackers impersonating AOL staff to extract users' passwords is regarded as one of the earliest cases. In the 2000s, phishing targeting online banking surged, and from the 2010s onward, attacks aimed at cloud services and social media accounts became mainstream. Since the mid-2020s, abusing generative AI has made it easy to create grammatically flawless phishing emails, rendering the traditional method of spotting "unnatural language" ineffective.

Types of Phishing and Comparison

Ordinary phishing targets the general public indiscriminately, but more advanced variants also exist. Spear phishing is a targeted attack aimed at a specific individual or organization, sending highly credible emails after researching the recipient's information in advance. Whaling is a form of spear phishing that targets executives (such as the CEO or CFO), deriving its name from going after the "whale." Smishing is phishing conducted via SMS, and vishing is a technique using phone calls. The precision of the attack and the financial damage tend to increase in the order of ordinary phishing → spear phishing → whaling.

Real-World Use Cases

In a workplace, the people targeted first are usually those in accounting or administration, for whom invoices and payment requests are routine. The typical pattern is an attachment or link disguised as an invoice, arriving from a sender whose domain differs from the real business partner's by just one character. The wording reads naturally and the amounts and company names are often real, so judging by "something feels off" alone is unreliable. The practical step for the recipient is to forward the message to the internal reporting channel before opening any attachment or link, rather than deciding alone. Assume the same email reached several colleagues and share it within the department; if it has already been opened, disconnect the device from the network, then change that account's password and revoke its sessions.

Attack Flow

How to Spot Phishing

To spot a phishing email, it is important to check the domain of the sender's address. Addresses that subtly differ from the legitimate domain (for example, amaz0n.com) are often used. In addition, wording that creates a sense of urgency, such as "your account will be suspended" or "respond within 24 hours," is a typical hallmark of phishing. Always check the destination URL before clicking and make sure it is the legitimate domain.

Countermeasures and Pitfalls in Practice

A common misconception in security work is the overconfidence of "I won't be fooled." Social engineering does not exploit a lack of knowledge; it exploits context such as being in a hurry or facing a request from a superior, so even people who understand the mechanics get caught when the conditions line up. If you run simulated phishing drills in an organization, preparing a channel where anyone who clicked can report it without hesitation stops more real damage than chasing a drop in click rates as the goal. By using a different, random password for each service, even if you fall victim to phishing on one service, you can prevent the damage from spreading to other services. Setting up two-factor authentication is also an effective countermeasure.