When scammers come angling for your data
What is phishing, how can you spot it and what can you do about it?
Ping! You've got mail. "Please verify your account details within 24 hours" or "Your latest statement is ready" reads the message, supposedly from your bank or the tax authorities. Sounds familiar? Phishing is dishonestly tricking people into disclosing information, such as banking/credit card details, personal data and account logins. Many people think they would never fall for a phishing scam. Yet Statistics Netherlands says that about one in every two hundred Dutch people were scammed last year. Almost everyone who has an e-mail address gets frequent phishing messages. So it's a problem that's well worth a closer look. This is the first of a two-part blog post about fishing. In part 1, I'll consider exactly what phishing is. Next week, I'll explain how to recognise and prevent it.
Recognising and preventing phishing
Phishing still popular with scammers
Crooks have been coming up with creative fake message scams for a very long time. As well as e-mail, they use SMS ('text messaging') and other communications channels to lure people into clicking on malicious links. A typical fraud was recently reported on Opgelicht?!, a popular consumer affairs programme from Dutch broadcaster AVROTROS. Victims received SMSs, supposedly from the Spanish postal service Correos, saying that they needed to pay a postage charge. Clicking the payment link in the message took the victims to a phishing website set up like the Correos site. There, they were prompted to enter their card details to pay the 1-euro postage charge. However, they were actually given membership of a dating website, at a cost of €48, chargeable to their cards. After that, victims were bombarded with e-mails about dating. The scam has been running since at least 2019, as evidenced by various reports [1, 2]. Clearly, phishing is an ongoing problem that warrants our attention.
Nothing new under the sun
Phishing comes under the general heading of 'spam': unwanted message traffic. It's a common misconception that phishing is confined to the internet. In fact, '419 fraud', or advance payment fraud, was around even before the internet existed. And similar scams have been documented as far back as the French revolution. Advance payment fraud was perpetrated using traditional post, and still goes on today. However, the arrival of the internet and especially e-mail made such scams much easier: suddenly the crooks could reach huge numbers of people at very little cost. The new technology therefore ushered in a flood of spam, including fraudulent phishing mail.
Phishing is scalable
Two messaging methods are widely used for phishing: e-mail and SMS. For scammers, those media have the attraction of being scalable. In other words, they lend themselves to bulk messaging. There's no charge for sending e-mail, and millions of messages can be sent quickly and easily, even with a low-power server. SMS messages are also easily sent in bulk. Unlike e-mail, they do cost money to send: 6 to 12 euro cents each, where modest volumes are involved. However, scammers are apt to avoid that cost by, for example, paying with stolen credit card details. If they do pay legitimately, the unit cost falls as volumes rise. And SMS-based phishing has the advantage that most of the traffic isn't filtered. So messages are much more likely to be seen by potential victims. All things considered, SMS has a lot going for it in the scammers' eyes.
Spoofing makes phishing even easier
Another reason why e-mail and SMS are the preferred media for phishing is that spoofing is easy with both. In its basic form, e-mail – or, to be precise, SMTP – lacks proper security. It's therefore child's play to falsify a 'From' address. Unauthorised individuals can easily send mail 'from' any e-mail domain that doesn't support secure internet standards, such as SPF, DKIM and DMARC. Scammers can therefore make phishing mail look more convincing by using an address that the recipient is likely to know and trust. E-mail security standards are effective only if supported by both the sending host and the receiving host: attaching a digital signature doesn't help to make a message secure if the recipient never checks the signatures on incoming mail, for example. Spoofing is possible with SMS too: the technology doesn't prevent unauthorised senders using the number of, say, a bank. Nevertheless, a lot of phishing doesn't actually involve spoofing. Plenty of phishing mail comes from unrelated e-mail addresses, and phishing SMSs are often sent by unfamiliar mobile numbers, making them easier to recognise.
Setting up a phishing attack
Many phishing scams involve a malicious website. Crooks do sometimes invite recipients to respond by mail, but that's fairly unusual and likely to be seen as suspicious by many potential victims. The normal tactic is therefore to use mail in combination with a fake website where victims' data can be harvested. In many cases, phishers pretend to be writing on behalf of a well-known organisation, such as a bank. The messages are designed to persuade recipients that they need to do something urgently – verify their account, for example – which involves clicking on a link. That takes the victim to a website, mocked up to look like the real website of the bank, or whatever organisation is being impersonated. Arriving on that the fake site, the victim is invited to enter important information, such as their account details. That brings me to the end of part 1 of my two-part phishing blog. In part 2, I'll explain how phishing messages can be recognised and prevented.
