What Is Phishing?

Phishing attacks explained

Phishing is one of the oldest forms of email attack, but it’s still prevalent in organizations of all sizes. It happens when fraudsters spam users online with emails. These emails sometimes promise prizes or threaten an account suspension, for example, then ask them to click on a link or go to a site to sort things out. Instead of winning a gift or reactivating that frozen credit card, users instead get their identities stolen or their computers infected with viruses.

How do phishing attacks work?

Phishing scams rely on tricking users into taking action — for example, in URL phishing, hackers want users to access a fake website and divulge passwords and sensitive information. The site often asks the user to reset a password, reenter personal and credit information to validate an account, or download a “software update,” which is really malware in disguise.

Phishing attacks are becoming more sophisticated

Threats to enterprise security are constantly evolving and growing in complexity, and phishing threats are no exception.

In a phishing email, attackers masquerade as a reputable entity or a known person to dupe users into sharing important information like login credentials or account information. In a spear phishing email, attackers often pose as an individual within the recipient’s company, while the sender of a whale phishing email might impersonate the CEO or CFO and instruct the recipient to transfer money to a fraudulent account.

These kinds of phishing threats have been enormously successful. In fact, 91% of all hacking attacks today began with a phishing or spear phishing email. With each breach potentially costing millions in damage to business, productivity and reputation, organizations need sophisticated protection to guard against these ever-evolving attacks.

Examples of phishing emails

Phishing emails can take many forms, but all share one goal: to deceive the unsuspecting user into revealing account credentials, contact information, or other sensitive data. These emails often contain a malicious link or malicious attachment, disguised to look legitimate.

Here are common examples:

• An email pretending to be from your bank, warning of suspicious activity and prompting you to click a link to "verify your account." The link leads to a fake site designed to steal your account credentials.
• A message that looks like it's from your company's IT team, asking you to download a "critical update" — which turns out to be a malicious attachment loaded with malware.
• A seemingly friendly email from a colleague asking you to review an attached document, which is actually part of a phishing scam launched by cyber criminals.

Each of these emails is crafted to look real, often using logos, names, or even previous email thread formats to make it more convincing.

Different types of phishing techniques

Phishing remains the most popular form of cyberattack, and it has endured despite all efforts to fight it off. Phishing remains the most popular form of cyberattack, and it has endured despite all efforts to fight it off. In recent years, phishing has evolved in new directions, such as:

• Targeted spear phishing – A personalized phishing attempt that impersonates a trusted individual, such as a coworker or vendor. These emails often reference real projects or internal details to trick the unsuspecting user into downloading a malicious attachment.
• Smsishing(via text message) – Short for SMS phishing, smishing attacks use text messages to lure victims into clicking fraudulent links or providing contact information. These messages often appear to come from banks, delivery services, or HR departments.
• Vishing (using voicemail) – Scammers pose as tech support, HR, or financial reps in a phone call. They pressure targets to reveal login credentials, reset passwords, or authorize transactions — all under the guise of resolving suspicious activity.
• Whaling – This form of phishing targets high-profile executives like CEOs or CFOs. Whaling emails typically request wire transfers or sensitive business data under urgent pretenses.
• Angler phishing – Found on social media, this technique impersonates legitimate customer service accounts to intercept complaints and trick users into sharing account credentials or clicking malicious links.
• Trap phishing – Attackers send bait emails containing fake job offers, invoices, or prize notifications. Once the user engages, they're led to phishing websites or prompted to download malicious attachments.
• Pharming – This advanced technique redirects users from legitimate websites to fake ones without their knowledge. Even if the user types the correct URL, they’re taken to a fraudulent site to steal sensitive information like passwords or payment details.

The impact of phishing attacks on businesses

The impact of phishing on businesses is harsh. According to annual reports by the Ponemon Institute, the average total cost of a data breach to a business, inclusive of damages like lost sales due to downtime, runs about $3.86 million. And as breaches get larger, so do the costs.

Industries most targeted by phishing emails

Phishing affects nearly every industry. Some are more frequently targeted due to the nature of the data they handle or their reliance on digital communication.

• Financial Services: Banks and credit unions are top targets due to the sensitive financial data they store. A single phishing message can lead to massive fraud.
• Healthcare: Hospitals and clinics often store vast amounts of personal data, making them vulnerable to attacks involving stolen contact information and account credentials.
• Retail and E-commerce: These businesses often fall victim to phishing scams that mimic customer support emails or shipping notifications containing malicious links.
• Education: Universities and schools may experience phishing attempts targeting staff or students, especially during enrollment or financial aid periods.

Defending against a phishing virus

A phishing virus typically starts with an email that seems to be from a legitimate source like a bank, a credit card company, a social website, an online payment processor or an IT administrator. The email directs the recipient to click on a link for a website that turns out to be malicious, and where the user is asked for some personal information like a passcode, credit card number, or account information. That info is then used to gain access to the user's accounts and to commit identity theft.

A spear-phishing virus is a more targeted phishing directed against a specific individual or role at the organization. This type of phishing virus attack uses social engineering techniques and information gathered about the individual to make the email more believable and increase the likelihood that the recipient will act on it.

Preventing phishing virus attacks requires sophisticated solutions that combine powerful email security technology with dynamic user awareness training. That's where Mimecast can help. 

How Mimecast technology prevents a phishing email attack

Mimecast's AI-powered Advanced Email Security defends against every type of phishing email threat.

Mimecast's impersonation protection capabilities a whaling attack that uses social engineering to trick employees into divulging confidential data or wiring funds to a fraudulent account.. Mimecast scans all inbound emails in real-time, searching for specific signs of fraud in the header, domain and content of the message.

Mimecast's URL protection capabilities prevent a phishing email attack by scanning all URLs within incoming and archived emails on every click and opening websites only if they have been determined to be safe.

Mimecast's attachment protection capabilities defend weaponized attachments by sandboxing attachments and allowing only safe documents to be sent to the user.

Benefits of Mimecast’s human-centric security solution for phishing attacks

With Mimecast's AI-powered Advanced Email Security, organizations can:

• Prevent a phishing attack, spear phishing attack or whale phishing threat without the need for additional infrastructure or IT overhead.
• Add instant protection for all devices with no disruption to end-users.
• Activate the service quickly through Mimecast’s cloud platform.
• Improve insight with end-to-end, real-time threat analysis and granular reporting.

Learn more about stopping a phishing attack or CEO Fraud and about Mimecast’s solution for spam email protection and ransomware detection.