How to detect – and avoid — phishing scams

Phishing is one of the Internet’s oldest and longest-running scam techniques. Since its first appearance in the mid-90s, it’s fooled countless individuals, costing people and organizations billions of dollars. And it shows no signs of slowing down.

Forty one percent of business email compromise breaches in 2022 involved phishing – according to the Verizon Data Breach Investigations Report.¹ And the international nonprofit Anti-Phishing Working Group reports that there were 381,717 phishes in June 2022² alone. How has this scam been so successful for so long?

Phishing is a method of social engineering designed to mislead people into believing they are dealing with a legitimate party. Cyber criminals employ deception, urgency, or too-good-to-be-true promises to exploit common human responses like trust in authority, fear of missing out, greed or curiosity.

The aim of phishing is to trick you into revealing sensitive data — which might include login credentials and passwords, credit card numbers, bank account numbers, corporate contacts, vendor names or other proprietary information — for fraudulent purposes. The scam is most delivered as an email that spoofs a known company, such as a bank or online shopping site, but it can also appear to come from an individual of authority or personal acquaintance.

Phishing emails may contain a link that sends users to a replica of a valid website where usernames, passwords and other data are transmitted to cyber criminals. From there, they can sell personal data on the dark web black market or use it to commit identity theft or drain bank accounts.

Today phishing scams have become more refined. Phishing may be widespread or targeted, sent by text or voicemail or even show up in search results. Data leaks and social media accounts with lax privacy settings often expose information on individuals and organizations that criminals can use to create smarter, more stealthy phishing content.

For all their sophistication, today’s phishing scams still rely on exploiting the human psyche. Detecting a phish therefore requires you to maintain a healthy level of skepticism when receiving any kind of digital communication and shore up on your best defense: awareness.