What is phishing and why is it called that? That’s a pretty easy one, really: The act of stealing someone’s credentials is sort of like fishing in water. There’s a group of targets, bait that is known to be of interest to them and a pretty good chance of at least catching something, even if it’s not the original meal you were after.

Fishermen adjust the bait and tackle they use depending on the situation. They don’t use the same tactics at a farm pond and for deep sea fishing. Similarly, cybercriminals typically use different bait and exploits depending on what they’re after. They might be looking for login credentials, credit card numbers or medical information.

Gone Phishing

In past decades, most attacks were carried out by hobbyists and malcontents trying to see what they could get away with. They mostly wanted to prove they could actually perform an exploit — for bragging rights, if you will. Today, we’re dealing with professional bad guys who work 9 a.m. to 5 p.m. with the primary goal of separating you from your information, and often your money. The value of whatever they’re after will determine just how serious they are and how much effort they put into catching you up in their nets.

The typical phishing attack aims to steal credentials that can be used to log in to other sites. In other words, they want your bank site logins, your investment account ID and password, even your game site ID if that game has something that can be traded for real cash.

Attackers use various sets of emails or IDs stolen in larger scams or breaches. For example, if fraudsters get their hands on the credentials of a company admin, that company’s entire user list of emails and other information may be put up for sale on the black market.

The More You Gnome

Let’s say that there is a set of emails known to be stolen from a company that makes lawn chairs. Maybe an attacker wants to get contact data from people that buy lawn chairs because he knows that they tend to have accounts on another site that sells garden gnomes. Our guy really likes gnomes.

The bad guy makes up an email that tells people who bought lawn chairs that their garden gnome account has been compromised and they need to login again to change their password. He’ll even give them a fake link to the garden gnome password reset webpage. If the lawn chair buyers click on the link, they go to a page that lets them enter their ID and password to reset it.

Of course, the fake site will just error out and tell them to try again later. However, our bad guy now has their gnome IDs and passwords, and can have little humanoid garden ornaments sent to his house on the victims’ dime.

Since many people use the same credentials for multiple accounts, fraudsters can use stolen information to log in to everything from banks and credit unions to gnome stores and social media accounts. Some even use the same user ID and password for their checking account that they use to log in to Facebook. Bad idea!

It’s Nothing Personal

Don’t click on every link you see in an email. If a bank sends you a notice to respond by clicking on something, don’t do it. Type the bank site name into your browser and control how you get to the site. Then examine the page to see if there is really a message on which you need to act.

Don’t reuse passwords! This is a biggie. If you happen to get phished through one site, don’t make it easy for them to use that ID and the password all over the world. Be suspicious; if someone you know sends you an email asking for help or money, contact them in another way to verify.

Unfortunately, the big takeaway here is that bad guys are, in fact, out to get you. It’s typically nothing personal — you’re just one email address in a list of millions of users.

Read the white paper: Adapt to new phishing threats and assess websites automatically

More from Fraud Protection

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

How Security Teams Combat Disinformation and Misinformation

“A lie can travel halfway around the world while the truth is still putting on its shoes.” That popular quote is often attributed to Mark Twain. But since we're talking about misinformation and disinformation, you’ll be unsurprised to learn Twain never said that at all. In fact, no one knows who first strung those words together, but the idea that truth spreads slowly while lies spread quickly is at least several hundred years old. The “Twain” quote also serves to…

A View Into Web(View) Attacks in Android

James Kilner contributed to the technical editing of this blog. Nethanella Messer, Segev Fogel, Or Ben Nun and Liran Tiebloom contributed to the blog. Although in the PC realm it is common to see financial malware used in web attacks to commit fraud, in Android-based financial malware this is a new trend. Traditionally, financial malware in Android uses overlay techniques to steal victims’ credentials. In 2022, IBM Security Trusteer researchers discovered a new trend in financial mobile malware that targets…

New DOJ Team Focuses on Ransomware and Cryptocurrency Crime

While no security officer would rely on this alone, it’s good to know the U.S. Department of Justice is increasing efforts to fight cyber crime. According to a recent address in Munich by Deputy Attorney General Lisa Monaco, new efforts will focus on ransomware and cryptocurrency incidents. This makes sense since the X-Force Threat Intelligence Index 2022 named ransomware as the top attack type in 2021. What exactly is the DOJ doing to improve policing of cryptocurrency and other cyber…