May 2, 2017 By Tim Heagarty 3 min read

What is phishing and why is it called that? That’s a pretty easy one, really: The act of stealing someone’s credentials is sort of like fishing in water. There’s a group of targets, bait that is known to be of interest to them and a pretty good chance of at least catching something, even if it’s not the original meal you were after.

Fishermen adjust the bait and tackle they use depending on the situation. They don’t use the same tactics at a farm pond and for deep sea fishing. Similarly, cybercriminals typically use different bait and exploits depending on what they’re after. They might be looking for login credentials, credit card numbers or medical information.

Gone Phishing

In past decades, most attacks were carried out by hobbyists and malcontents trying to see what they could get away with. They mostly wanted to prove they could actually perform an exploit — for bragging rights, if you will. Today, we’re dealing with professional bad guys who work 9 a.m. to 5 p.m. with the primary goal of separating you from your information, and often your money. The value of whatever they’re after will determine just how serious they are and how much effort they put into catching you up in their nets.

The typical phishing attack aims to steal credentials that can be used to log in to other sites. In other words, they want your bank site logins, your investment account ID and password, even your game site ID if that game has something that can be traded for real cash.

Attackers use various sets of emails or IDs stolen in larger scams or breaches. For example, if fraudsters get their hands on the credentials of a company admin, that company’s entire user list of emails and other information may be put up for sale on the black market.

The More You Gnome

Let’s say that there is a set of emails known to be stolen from a company that makes lawn chairs. Maybe an attacker wants to get contact data from people that buy lawn chairs because he knows that they tend to have accounts on another site that sells garden gnomes. Our guy really likes gnomes.

The bad guy makes up an email that tells people who bought lawn chairs that their garden gnome account has been compromised and they need to login again to change their password. He’ll even give them a fake link to the garden gnome password reset webpage. If the lawn chair buyers click on the link, they go to a page that lets them enter their ID and password to reset it.

Of course, the fake site will just error out and tell them to try again later. However, our bad guy now has their gnome IDs and passwords, and can have little humanoid garden ornaments sent to his house on the victims’ dime.

Since many people use the same credentials for multiple accounts, fraudsters can use stolen information to log in to everything from banks and credit unions to gnome stores and social media accounts. Some even use the same user ID and password for their checking account that they use to log in to Facebook. Bad idea!

It’s Nothing Personal

Don’t click on every link you see in an email. If a bank sends you a notice to respond by clicking on something, don’t do it. Type the bank site name into your browser and control how you get to the site. Then examine the page to see if there is really a message on which you need to act.

Don’t reuse passwords! This is a biggie. If you happen to get phished through one site, don’t make it easy for them to use that ID and the password all over the world. Be suspicious; if someone you know sends you an email asking for help or money, contact them in another way to verify.

Unfortunately, the big takeaway here is that bad guys are, in fact, out to get you. It’s typically nothing personal — you’re just one email address in a list of millions of users.

Read the white paper: Adapt to new phishing threats and assess websites automatically

More from Fraud Protection

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today