As part of our Cybersecurity Awareness Month series, we’re taking a closer look at phishing – one of the most common and dangerous cyber threats. Knowing what phishing is, why it’s done, and how to spot and respond to it can significantly protect our data and maintain a secure work environment.

What is Phishing?

Phishing is a form of cyberattack in which a malicious actor impersonates a trusted entity to deceive individuals into sharing sensitive information, such as login credentials, credit card details, or personal data. A malicious actor (or bad actor) is any individual or group that intentionally engages in harmful activities to compromise security, steal data, or cause damage. These attackers often use deception to manipulate people into taking actions that benefit their schemes, such as clicking on a malicious link or revealing confidential information. 

Why is Phishing Done?

Cybercriminals employ phishing for several purposes:

  • Financial gain: Stolen data can be sold on the dark web or used for fraudulent transactions. 
  • Identity theft: Personal information can be exploited to impersonate victims. 
  • Data breaches: Phishing can be the entry point for larger scale cyberattacks targeting an organization’s sensitive data. 
  • Spreading malware: Some phishing attacks aim to install malicious software on the recipient’s device to spy on activities or disrupt operations. 

The consequences of falling for a phishing attempt can range from financial losses to reputational damage and compromised security. Being able to identify these schemes is crucial.

Ways of Phishing

Phishing can come in different forms, with varying degrees of sophistication. Here are the most common types:

  • Email Phishing: The attacker sends a fraudulent email, often with a sense of urgency. For example, an email may claim that your account has been compromised and that you must reset your password immediately. 
  • Spear Phishing: These are targeted attacks aimed at specific individuals or organizations. The content is usually personalized, making it seem more legitimate. 
  • Smishing (SMS Phishing): Phishing attempts delivered via text messages. The message may appear from a financial institution requesting account information verification. 
  • Vishing (Voice Phishing): Phishing is conducted over the phone. The attacker might impersonate a bank representative and request sensitive information. 
  • Clone Phishing: The attacker creates a nearly identical copy of a legitimate email that was previously sent. The cloned email contains malicious links or attachments. 
  • Business Email Compromise (BEC): This type of scam Targets businesses by impersonating a high-ranking executive or a trusted partner to request money transfers or sensitive data. 

How to Recognize Phishing

Identifying phishing attempts requires vigilance and an understanding of common red flags. Here’s what to watch for:

  • Urgency or fear tactics: Messages claiming your account will be closed, or you’ll face the consequences unless you act immediately. 
  • Suspicious sender: An email address that doesn’t match the organization it claims to represent or one that is slightly altered to resemble a legitimate one (e.g., “[email protected]” instead of “[email protected]”). 
  • Generic greetings: Messages addressing you as “Dear Customer” instead of your name. 
  • Unusual or unexpected requests: Requests for sensitive information such as passwords, Social Security numbers, or financial details. 
  • Poor grammar or spelling mistakes: Legitimate organizations typically avoid sending emails with typos and awkward phrasing. 
  • Unfamiliar links or attachments: Hover over links to see where they lead before clicking. If the URL doesn’t look right, it’s probably not safe. 

Examples of Phishing Attempts

To help illustrate these red flags, here are a few common examples:

  • The Fake Invoice Scam: You receive an email with a subject like “Payment Due – Invoice Attached.” The attachment is malicious and designed to install malware. 
  • Account Update Alert: An email claims suspicious activity on your account and asks you to click a link to “verify your identity.” The link leads to a fake website that looks like the real one. 
  • CEO Fraud: A cybercriminal impersonates the CEO of your company and sends an urgent email to an employee requesting an immediate transfer of funds to a specified account. 

What To Do if You Suspect Phishing

If you come across a potential phishing attempt, follow these steps to stay safe: 

  • Don’t click on any links or open attachments. It’s safer to go directly to the official website by typing the URL into your browser. 
  • Verify the source. If the message is from someone you know but seems suspicious, contact them through a different communication channel to confirm. 
  • Report the phishing attempt. Forward the suspicious email or message to the IT or security team. Reporting helps protect the organization from similar threats. 
  • Delete the message. After reporting the phishing attempt, remove it from your inbox to avoid accidental clicks.

Working Together to Protect Our Data

Our commitment to cybersecurity requires a team effort, and recognizing phishing is just one aspect of safeguarding our organization. Completing the annual online cybersecurity training is vital to stay informed about the latest tactics used by hackers and phishers. This training equips us with the tools and knowledge to protect sensitive information. 

“Cybersecurity is everyone’s responsibility,” said Greg Parsons, Tidal Basin CIO. “The more vigilant we are, the harder we make it for cybercriminals to exploit our systems. Completing your annual training and being alert to phishing threats are essential to keep our data secure.”

Let’s work together to create a culture of security. By staying informed, recognizing the signs of phishing, and taking action when something seems suspicious, we can help keep our organization safe from cyber threats. Remember, one click can make all the difference—stay vigilant and protect our data. Learn more by visiting the Cybersecurity and Infrastructure Security Agency’s resources.