How to Identify Phishing Scams

What is Phishing?

Phishing is a cyberattack tactic where threat actors employ social engineering to manipulate people into divulging sensitive information, such as login credentials, financial data, or corporate secrets. 

These attacks exploit psychological triggers—urgency, fear, or trust—to deceive individuals into taking harmful actions, including clicking malicious links, downloading malware, or transferring funds. 

Attackers often impersonate trusted entities (e.g., colleagues, executives, or reputable organizations) via email, SMS, phone calls, or fraudulent websites to bypass technical defenses.

Proactive detection is critical to mitigating phishing risks. Below are key attack types and indicators:

Email Phishing

Fraudulent emails impersonating legitimate organizations to obtain personal or financial data.

Example:

Subject: Exclusive Education Technology Contact List

Hi Jeff,
Would you like a comprehensive list of Education Technology professionals for marketing purposes? This offer ends at midnight.
For the full list, provide:
- First/Last Name
- Email/Phone
- Mailing Address
- Company Details

Kind Regards,
Emma Johnson
Head of Marketing

Red Flags:

• Unsolicited requests for sensitive data.

• Generic greetings (“Hi Jeff”) without personalization.

• Pressure to act quickly (“Offer ends at midnight”).

Spear Phishing

Targeted attacks tailored to specific individuals or organizations.

Example:

Subject: Urgent Wire Transfer Required

Dear Emma,

There is a time-sensitive opportunity that requirues your immediate attention. I need you to process a $300,000 wire transfer to our international HQ within 30 minutes.
Bank: Capital Wells Credit Union
Account: 123456789101
Passcode: 123456

Best Regrads,
Doug Smith

Red Flags:

• Urgent language (“time-sensitive opportunity”).

• Grammatical errors (“requirues,” “Regrads”).

• Unverified sender address (e.g., non-corporate domain).

Smishing & Vishing

• Smishing: Malicious SMS messages (e.g., fake verification codes).

• Vishing: Voicemails urging immediate callback to fraudulent numbers.

Example:

Text: “Your Coinbase verification code: 941317. Do not share this code with anyone. If this was not you, please call: +13206402838 Ref: CB93827”

Red Flags:

• Unsolicited codes or links from unknown numbers.

• Requests to “verify” information via phone.

Whaling

High-level attacks targeting executives or financial personnel.

Example:

Case Study: Mattel’s Near $3M Loss

Attackers impersonated the CEO via email, instructing a finance officer to transfer $3M to a Chinese account. While Mattel recovered funds, most organizations face irreversible losses.

Red Flags:

• Requests bypassing standard approval workflows.

Malware Distribution

Malicious attachments or links disguised as legitimate updates or offers.

Example:

Subject: Adobe 50% Discount – Limited Time!
“Download now to claim your subscription discount before midnight.”

Red Flags:

• Unsolicited software updates or discounts.

• File extensions like .exe or .zip from unknown senders.

Defense Strategies

1. Zero Trust Verification: Confirm unusual requests via secondary channels (e.g., in-person or encrypted chat).

2. Email Authentication: Implement DMARC (Domain-based Message Authentication), SPF (Sender Policy Framework), and DKIM (DomainKeys Identified Mail) to block spoofed domains.

3. Endpoint Protection: Deploy anti-malware tools to detect malicious payloads.

4. Security Training: Conduct phishing simulations to improve employee awareness.

Phishing remains a top breach vector, with IBM reporting it as the cause of 15% of incidents. By combining technical controls with user education, organizations can reduce their attack surface effectively.

Sources

Kosinski, Matthew. “What Is Phishing?” IBM, 19 Dec. 2024, www.ibm.com/think/topics/phishing. 

Nang Yip, Ki. “Whaling Case Study: Mattel’s $3 Million Phishing Adventure.” Infosec, 16 May 2016, www.infosecinstitute.com/resources/phishing/whaling-case-study/.