What is Phishing?

Phishing is a type of cybercrime that involves tricking individuals into giving away sensitive information, such as passwords, credit card numbers, and other personal information. The attackers use fake emails, websites, and text messages that appear to be from a trusted source, such as a bank, a social media site, or a company, to lure the victim into providing their information.

Phishing attacks can take many forms, but they all have the same goal: to steal sensitive information. Some common methods of phishing include:

Email phishing: A fake email that appears to be from a trusted source is sent to a victim, asking them to provide their login credentials or other sensitive information.

Website phishing: The attacker creates a fake website that looks like a legitimate site, such as a bank's website, and asks the victim to enter their login credentials or other sensitive information.

SMS phishing: The attacker sends a text message to a victim, asking them to provide their information or follow a link to a fake website.

Voice phishing: The attacker calls a victim and pretends to be from a trusted source, such as a bank, and asks for their information.

Once a phishing attacker has obtained sensitive information, they can use it for fraudulent purposes, such as making unauthorized purchases, stealing money from bank accounts, or taking over social media accounts. They can also use the information to steal the victim's identity and commit other types of fraud.

It's important to be cautious when providing personal information online, and to only enter sensitive information on websites that are secure and that you trust. Additionally, it's a good idea to regularly monitor your bank accounts and other sensitive information to ensure that it hasn't been compromised.

Simplified Example

Phishing can be compared to someone pretending to be someone else to steal something from you. Just like how a thief might pretend to be a friend or a delivery person to get inside your home and steal your things, a phisher might pretend to be a trusted website or company to trick you into giving them sensitive information like your passwords or credit card numbers.

Imagine you're playing with your friends and one of them comes to you with a ball, asking if you want to play catch. But, it's not actually your friend, it's someone pretending to be them to steal your ball. This is similar to what happens in phishing. Someone might send you an email or message that looks like it's from a trusted source, like your bank, and ask you to click on a link or provide information. But, just like the person who wasn't actually your friend, the email or message is from someone pretending to be a trusted source to steal your information.

So, it's important to be careful and always make sure you're giving your information to the right people. Before you enter any information online or click on a link, make sure it's from a trusted source by checking the web address and looking for the secure padlock icon in the browser. And, always be cautious when someone asks for sensitive information, even if it looks like it's from a trusted source.

Who Invented Phishing?

The origin of the term "phishing" is a subject of debate, with two main figures often credited for its invention. Khan C. Smith, a notorious hacker and spammer in the late 1990s, is widely considered the primary inventor. In 1995, he used the term "phishing" in a Usenet newsgroup to describe a technique he employed to steal America Online (AOL) accounts. Smith's method involved sending deceptive emails, masquerading as legitimate AOL communications, to trick users into disclosing their login credentials. Another potential origin lies in the "AOHell" Cracking Toolkit, where some sources suggest the term might have appeared earlier in 1995. This toolkit contained information on various hacking techniques, and speculation exists that it may have included a reference to "phishing" before Smith's Usenet post. While pinpointing the term's exact origin remains challenging due to limitations in digital archives and the decentralized nature of early internet communities, Khan C. Smith's documented use in 1995 stands as the most concrete evidence, establishing him as the widely recognized pioneer of the term "phishing."

Examples

Email Phishing: Email phishing is a type of attack in which a attacker sends a fake email that appears to be from a trusted source, such as a financial institution, in an attempt to trick the recipient into revealing sensitive information, such as login credentials or credit card information. The email typically includes a link to a fake website that is designed to look like the real thing and is used to capture the information entered by the victim. This type of phishing attack is particularly dangerous as the emails can be made to look very convincing, and many people are unaware that they are giving away their personal information.

SMS Phishing: SMS phishing, also known as "smishing," is a type of attack that uses text messages to trick the recipient into revealing sensitive information. The text message may appear to be from a trusted source, such as a bank or mobile phone company, and may include a link to a fake website that is designed to capture the victim's information. This type of phishing attack is becoming increasingly common, as more and more people rely on text messaging for communication.

Voice Phishing: Voice phishing, also known as "vishing," is a type of phishing attack that uses the telephone to trick the victim into revealing sensitive information. The attacker may call the victim and pretend to be a representative from a bank, government agency, or other trusted organization. The attacker will then ask for sensitive information, such as login credentials or credit card information, under the guise of verifying the victim's account. This type of phishing attack can be particularly dangerous, as the attacker may be able to use social engineering techniques to convince the victim to reveal their information.

Related Terms

• Replay Attack: A type of cyber attack that occurs when a malicious actor intercepts a valid network transmission and then retransmits it at a later time.

• Phone Phishing: A type of social engineering attack that uses voice calls or recorded messages to trick individuals into revealing sensitive information, such as passwords, credit card numbers, or personal identification numbers (PINs).