HOME

TheInfoList



OR:

Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing
sensitive information Information sensitivity is the control of access to information or knowledge that might result in loss of an advantage or level of security if disclosed to others. Loss, misuse, modification, or unauthorized access to sensitive information can a ...
to the attacker or to deploy malicious software on the victim's infrastructure like
ransomware Ransomware is a type of malware from cryptovirology that threatens to publish the victim's personal data or permanently block access to it unless a ransom is paid off. While some simple ransomware may lock the system without damaging any files, ...
. Phishing attacks have become increasingly sophisticated and often transparently mirror the site being targeted, allowing the attacker to observe everything while the victim is navigating the site, and transverse any additional security boundaries with the victim. As of 2020, phishing is by far the most common attack performed by cybercriminals, the
FBI The Federal Bureau of Investigation (FBI) is the domestic intelligence and security service of the United States and its principal federal law enforcement agency. Operating under the jurisdiction of the United States Department of Justice, t ...
's Internet Crime Complaint Centre recording over twice as many incidents of phishing than any other type of computer crime. The first recorded use of the term "phishing" was in the cracking toolkit AOHell created by Koceilah Rekouche in 1995; however, it is possible that the term was used before this in a print edition of the hacker magazine '' 2600''. The word is a variant of ''fishing'', influenced by
phreaking Phreaking is a slang term coined to describe the activity of a culture of people who study, experiment with, or explore telecommunication systems, such as equipment and systems connected to public telephone networks. The term ''phreak'' is a ...
, and alludes to the use of increasingly sophisticated lures to "fish" for users' sensitive information. Attempts to prevent or mitigate the impact of phishing incidents include
legislation Legislation is the process or result of enrolling, enacting, or promulgating laws by a legislature, parliament, or analogous governing body. Before an item of legislation becomes law it may be known as a bill, and may be broadly referred to a ...
, user training, public awareness, and technical security measures. Phishing awareness has become important at home and at the work place. For instance, from 2017 to 2020, phishing attacks have increased from 72% to 86% among businesses.


Types


Email phishing

Most phishing messages are delivered by
email spam Email spam, also referred to as junk email, spam mail, or simply spam, is unsolicited messages sent in bulk by email (spamming). The name comes from a Monty Python sketch in which the name of the canned pork product Spam is ubiquitous, unavoida ...
, and are not personalized or targeted to a specific individual or company–this is termed "bulk" phishing. The content of a bulk phishing message varies widely depending on the goal of the attacker–common targets for impersonation include banks and financial services, email and cloud productivity providers, and streaming services. Attackers may use the credentials obtained to directly steal money from a victim, although compromised accounts are often used instead as a jumping-off point to perform other attacks, such as the theft of proprietary information, the installation of
malware Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, dep ...
, or the spear phishing of other people within the target's organization. Compromised streaming service accounts are usually sold directly to consumers on
darknet market A darknet market is a commercial website on the dark web that operates via darknets such as Tor or I2P. They function primarily as black markets, selling or brokering transactions involving drugs, cyber-arms, weapons, counterfeit currency, sto ...
s.


Spear phishing

Spear phishing involves an attacker directly targeting a specific organization or person with tailored phishing communications. This is essentially the creation and sending of emails to a particular person to make the person think the email is legitimate. In contrast to bulk phishing, spear phishing attackers often gather and use personal information about their target to increase their probability of success of the attack. Spear phishing typically targets executives or those that work in financial departments that have access to the organization's sensitive financial data and services. A 2019 study showed that accountancy and audit firms are frequent targets for spear phishing owing to their employees' access to information that could be valuable to criminals. Threat Group-4127 (Fancy Bear) used spear phishing tactics to target email accounts linked to
Hillary Clinton Hillary Diane Rodham Clinton ( Rodham; born October 26, 1947) is an American politician, diplomat, and former lawyer who served as the 67th United States Secretary of State for President Barack Obama from 2009 to 2013, as a United States senat ...
's 2016 presidential campaign. They attacked more than 1,800
Google Google LLC () is an American multinational technology company focusing on search engine technology, online advertising, cloud computing, computer software, quantum computing, e-commerce, artificial intelligence, and consumer electronics. I ...
accounts and implemented the accounts-google.com domain to threaten targeted users. A recent study tested the susceptibility of certain age groups against spear phishing. In total, 100 young and 58 older users received, without their knowledge, daily simulated phishing emails over 21 days. A browser plugin recorded their clicking on links in the emails as an indicator of their susceptibility. Forty-three percent of users fell for the simulated phishing emails, with older women showing the highest susceptibility. While susceptibility in young users declined across the study, susceptibility in older users remained stable.


Whaling and CEO fraud

Whaling refers to spear phishing attacks directed specifically at senior executives and other high-profile targets. The content will be likely crafted to be of interest to the person or role targeted (such as a
subpoena A subpoena (; also subpœna, supenna or subpena) or witness summons is a writ issued by a government agency, most often a court, to compel testimony by a witness or production of evidence under a penalty for failure. There are two common types of ...
or customer complaint). CEO fraud is effectively the opposite of whaling; it involves the crafting of spoofed emails purportedly ''from'' senior executives with the intention of getting other employees at an organization to perform a specific action, usually the wiring of money to an offshore account. While CEO fraud has a reasonably low success rate, criminals can gain very large sums of money from the few attempts that do succeed. There have been multiple instances of organizations losing tens of millions of dollars to such attacks.


Clone phishing

Clone phishing is a type of phishing attack whereby a legitimate, and previously delivered email containing an attachment or link has had its content and recipient address(es) taken and used to create an almost identical or cloned email. The attachment or link within the email is replaced with a malicious version and then sent from an email address spoofed to appear to come from the original sender. It may claim to be a resend of the original or an updated version to the original. Typically this requires either the sender or recipient to have been previously hacked for the malicious third party to obtain the legitimate email.


Voice phishing

Voice phishing, or vishing, is the use of telephony (often
Voice over IP Voice over Internet Protocol (VoIP), also called IP telephony, is a method and group of technologies for the delivery of voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet. The terms Internet ...
telephony) to conduct phishing attacks. Attackers will dial a large quantity of telephone numbers and play automated recordings—often made using
text-to-speech Speech synthesis is the artificial production of human speech. A computer system used for this purpose is called a speech synthesizer, and can be implemented in software or hardware products. A text-to-speech (TTS) system converts normal languag ...
synthesizers—that make false claims of fraudulent activity on the victim's bank accounts or credit cards. The calling phone number will be spoofed to show the real number of the bank or institution impersonated. The victim is then directed to call a number controlled by the attackers, which will either automatically prompt them to enter sensitive information in order to "resolve" the supposed fraud, or connect them to a live person who will attempt to use social engineering to obtain information. Voice phishing capitalizes on the lower awareness among the general public of techniques such as caller ID spoofing and automated dialing, compared to the equivalents for email phishing, and thereby the inherent trust that many people have in voice telephony.


SMS phishing

SMS phishing or smishing is conceptually similar to email phishing, except attackers use cell phone text messages to deliver the "bait". Smishing attacks typically invite the user to click a link, call a phone number, or contact an email address provided by the attacker via SMS message. The victim is then invited to provide their private data; often, credentials to other websites or services. Furthermore, due to the nature of mobile browsers, URLs may not be fully displayed; this may make it more difficult to identify an illegitimate logon page. As the mobile phone market is now saturated with
smartphone A smartphone is a portable computer device that combines mobile telephone and computing functions into one unit. They are distinguished from feature phones by their stronger hardware capabilities and extensive mobile operating systems, which ...
s which all have fast internet connectivity, a malicious link sent via SMS can yield the same result as it would if sent via
email Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronic (digital) version of, or counterpart to, mail, at a time when "mail" meant ...
. Smishing messages may come from telephone numbers that are in a strange or unexpected format.


Page hijacking

Page hijacking involves compromising legitimate web pages in order to redirect users to a malicious website or an
exploit kit An exploit kit is a tool used for automatically managing and deploying exploits against a target computer. Exploit kits allow attackers to deliver malware without having advanced knowledge of the exploits being used. Browser exploits are typica ...
via cross site scripting. A
hacker A hacker is a person skilled in information technology who uses their technical knowledge to achieve a goal or overcome an obstacle, within a computerized system by non-standard means. Though the term ''hacker'' has become associated in popu ...
may compromise a website and insert an
exploit kit An exploit kit is a tool used for automatically managing and deploying exploits against a target computer. Exploit kits allow attackers to deliver malware without having advanced knowledge of the exploits being used. Browser exploits are typica ...
such as MPack in order to compromise legitimate users who visit the now compromised web server. One of the simplest forms of page hijacking involves altering a webpage to contain a malicious
inline frame An HTML element is a type of HTML (HyperText Markup Language) document component, one of several types of HTML nodes (there are also text nodes, comment nodes and others). The first used version of HTML was written by Tim Berners-Lee in 1993 ...
which can allow an
exploit kit An exploit kit is a tool used for automatically managing and deploying exploits against a target computer. Exploit kits allow attackers to deliver malware without having advanced knowledge of the exploits being used. Browser exploits are typica ...
to load. Page hijacking is frequently used in tandem with a watering hole attack on corporate entities in order to compromise targets.


Calendar phishing

Calendar phishing is when phishing links are delivered via calendar invitations. Calendar invitations are sent, which by default, are automatically added to many calendars. These invitations often take the form of RSVP and other common event requests. Former Google click fraud czar
Shuman Ghosemajumder Shuman Ghosemajumder (born 1974) is a Canadian technologist, entrepreneur, and author. He is the former click fraud czar at Google, the author of works on technology and business including the Open Music Model, and co-founder of TeachAids. He wa ...
believes this form of fraud is increasing, and recommends changing calendar settings to not automatically add new invitations.


Techniques


Link manipulation

Most types of phishing use some form of technical deception designed to make a link in an email appear to belong to the organization the attackers are impersonating. Misspelled URLs or the use of
subdomain In the Domain Name System (DNS) hierarchy, a subdomain is a domain that is a part of another (main) domain. For example, if a domain offered an online store as part of their website example.com, it might use the subdomain shop.example.com . Ov ...
s are common tricks used by phishers. In the following example URL, , it can appear to the untrained eye as though the URL will take the user to the ''example'' section of the ''yourbank'' website; actually this URL points to the "''yourbank''" (i.e. phishing) section of the ''example'' website. Another common trick is to make the displayed text for a link suggest a reliable destination, when the link actually goes to the phishers' site. Many desktop email clients and web browsers will show a link's target URL in the status bar while hovering the
mouse A mouse ( : mice) is a small rodent. Characteristically, mice are known to have a pointed snout, small rounded ears, a body-length scaly tail, and a high breeding rate. The best known mouse species is the common house mouse (''Mus musculus'' ...
over it. This behavior, however, may in some circumstances be overridden by the phisher.
Internationalized domain name An internationalized domain name (IDN) is an Internet domain name that contains at least one label displayed in software applications, in whole or in part, in non-latin script or alphabet, such as Arabic, Bengali, Chinese (Mandarin, simplifie ...
s (IDNs) can be exploited via IDN spoofing or homograph attacks, to create web addresses visually identical to a legitimate site, that lead instead to malicious version. Phishers have taken advantage of a similar risk, using open URL redirectors on the websites of trusted organizations to disguise malicious URLs with a trusted domain. Even digital certificates do not solve this problem because it is quite possible for a phisher to purchase a valid certificate and subsequently change content to spoof a genuine website, or, to host the phish site without
SSL SSL may refer to: Entertainment * RoboCup Small Size League, robotics football competition * '' Sesame Street Live'', a touring version of the children's television show * StarCraft II StarLeague, a Korean league in the video game Natural languag ...
at all.


Filter evasion

Phishers have sometimes used images instead of text to make it harder for anti-phishing filters to detect the text commonly used in phishing emails. In response, more sophisticated anti-phishing filters are able to recover hidden text in images using
optical character recognition Optical character recognition or optical character reader (OCR) is the electronic or mechanical conversion of images of typed, handwritten or printed text into machine-encoded text, whether from a scanned document, a photo of a document, a sc ...
(OCR).


Social engineering

Most types of phishing involve some kind of social engineering, in which users are psychologically manipulated into performing an action such as clicking a link, opening an attachment, or divulging confidential information. In addition to the obvious impersonation of a trusted entity, most phishing involves the creation of a sense of urgency - attackers claim that accounts will be shut down or seized unless the victim takes an action. This occurs most often with victims bank or insurance accounts. An alternative technique to impersonation-based phishing is the use of
fake news Fake news is false or misleading information presented as news. Fake news often has the aim of damaging the reputation of a person or entity, or making money through advertising revenue.Schlesinger, Robert (April 14, 2017)"Fake news in reality ...
articles designed to provoke outrage, causing the victim to click a link without properly considering where it could lead. These links are designed to take you to a professional looking website that looks exactly like the legitimate organization's website. Once on the attacker's website, victims can be presented with imitation "virus" notifications or redirected to pages that attempt to exploit web browser vulnerabilities to install malware.


History


1980s

A phishing technique was described in detail in a paper and presentation delivered to the 1987 International HP Users Group, Interex.


1990s

The term "phishing" is said to have been coined by the well known spammer and hacker in the mid-90s, Khan C. Smith. The first recorded mention of the term is found in the hacking tool AOHell (according to its creator), which included a function for attempting to steal the
password A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
s or financial details of America Online users.


Early AOL phishing

Phishing on
AOL AOL (stylized as Aol., formerly a company known as AOL Inc. and originally known as America Online) is an American web portal and online service provider based in New York City. It is a brand marketed by the current incarnation of Yahoo! Inc. ...
was closely associated with the
warez Warez is a common computing and broader cultural term referring to pirated software (i.e. illegally copied, often after deactivation of anti-piracy measures) that is distributed via the Internet. Warez is used most commonly as a noun, a plura ...
community that exchanged unlicensed software and the black hat hacking scene that perpetrated credit card fraud and other online crimes. AOL enforcement would detect words used in AOL chat rooms to suspend the accounts of individuals involved in counterfeiting software and trading stolen accounts. The term was used because "<><" is the single most common tag of HTML that was found in all chat transcripts naturally, and as such could not be detected or filtered by AOL staff. The symbol <>< was replaced for any wording that referred to stolen credit cards, accounts, or illegal activity. Since the symbol looked like a fish, and due to the popularity of
phreaking Phreaking is a slang term coined to describe the activity of a culture of people who study, experiment with, or explore telecommunication systems, such as equipment and systems connected to public telephone networks. The term ''phreak'' is a ...
it was adapted as "Phishing". AOHell, released in early 1995, was a program designed to hack AOL users by allowing the attacker to pose as an AOL staff member, and send an
instant message Instant messaging (IM) technology is a type of online chat allowing real-time text transmission over the Internet or another computer network. Messages are typically transmitted between two or more parties, when each user inputs text and trigge ...
to a potential victim, asking him to reveal his password. In order to lure the victim into giving up sensitive information, the message might include imperatives such as "verify your account" or "confirm billing information". Once the victim had revealed the password, the attacker could access and use the victim's account for fraudulent purposes. Both phishing and warezing on AOL generally required custom-written programs, such as AOHell. Phishing became so prevalent on AOL that they added a line on all instant messages stating: "no one working at AOL will ask for your password or billing information". A user using both an AIM account and an AOL account from an
ISP An Internet service provider (ISP) is an organization that provides services for accessing, using, or participating in the Internet. ISPs can be organized in various forms, such as commercial, community-owned, non-profit, or otherwise private ...
simultaneously could phish AOL members with relative impunity as internet AIM accounts could be used by non-AOL internet members and could not be actioned (i.e., reported to AOL TOS department for disciplinary action).. In late 1995, AOL crackers resorted to phishing for legitimate accounts after AOL brought in measures in late 1995 to prevent using fake, algorithmically generated credit card numbers to open accounts. Eventually, AOL's policy enforcement forced copyright infringement off AOL servers, and AOL promptly deactivates accounts involved in phishing, often before the victims could respond. The shutting down of the
warez scene The Warez scene, often referred to as The Scene, is a worldwide, underground, organized network of pirate groups specializing in obtaining and illegally releasing digital media for free before their official sale date. The Scene distributes all fo ...
on AOL caused most phishers to leave the service.


2000s

* 2001 ** The first known direct attempt against a payment system affected
E-gold e-gold was a digital gold currency operated by Gold & Silver Reserve Inc. (G&SR) that allowed users to open an account on their web site denominated in grams of gold, or other precious metals, and that let users make instant transfers of value ( ...
in June 2001, which was followed up by a "post-9/11 id check" shortly after the September 11 attacks on the World Trade Center. * 2003 ** The first known phishing attack against a retail bank was reported by ''
The Banker ''The Banker'' is an English-language monthly international financial affairs publication owned by ''The Financial Times'' Ltd. and edited in London, United Kingdom. The magazine was first published in January 1926 through founding Editor, Brend ...
'' in September 2003. * 2004 ** It is estimated that between May 2004 and May 2005, approximately 1.2 million computer users in the
United States The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territo ...
suffered losses caused by phishing, totaling approximately . United States businesses lose an estimated per year as their clients become victims. ** Phishing is recognized as a fully organized part of the black market. Specializations emerged on a global scale that provided phishing software for payment (thereby outsourcing risk), which were assembled and implemented into phishing campaigns by organized gangs. * 2005 ** In the
United Kingdom The United Kingdom of Great Britain and Northern Ireland, commonly known as the United Kingdom (UK) or Britain, is a country in Europe, off the north-western coast of the continental mainland. It comprises England, Scotland, Wales and Nor ...
losses from web banking fraud—mostly from phishing—almost doubled to in 2005, from in 2004, while 1 in 20 computer users claimed to have lost out to phishing in 2005. * 2006 ** Almost half of phishing thefts in 2006 were committed by groups operating through the
Russian Business Network The Russian Business Network (commonly abbreviated as RBN) is a multi-faceted cybercrime organization, specializing in and in some cases monopolizing personal identity theft for resale. It is the originator of MPack and an alleged operator of the ...
based in
St. Petersburg Saint Petersburg ( rus, links=no, Санкт-Петербург, a=Ru-Sankt Peterburg Leningrad Petrograd Piter.ogg, r=Sankt-Peterburg, p=ˈsankt pʲɪtʲɪrˈburk), formerly known as Petrograd (1914–1924) and later Leningrad (1924–1991), i ...
. ** Banks dispute with customers over phishing losses. The stance adopted by the UK banking body
APACS The UK Payments Administration Ltd (UKPA) is a United Kingdom service company that provides people, facilities and expertise to the UK payments industry. UKPA was created on 6 July 2009, as a successor of the Association for Payment Clearing Ser ...
is that "customers must also take sensible precautions ... so that they are not vulnerable to the criminal." Similarly, when the first spate of phishing attacks hit the Irish Republic's banking sector in September 2006, the
Bank of Ireland Bank of Ireland Group plc ( ga, Banc na hÉireann) is a commercial bank operation in Ireland and one of the traditional Big Four Irish banks. Historically the premier banking organisation in Ireland, the Bank occupies a unique position in Iris ...
initially refused to cover losses suffered by its customers, although losses to the tune of
The euro sign () is the currency sign used for the euro, the official currency of the eurozone and unilaterally adopted by Kosovo and Montenegro. The design was presented to the public by the European Commission on 12 December 1996. It consists o ...
113,000 were made good. ** Phishers are targeting the customers of banks and online payment services. Emails, supposedly from the
Internal Revenue Service The Internal Revenue Service (IRS) is the revenue service for the United States federal government, which is responsible for collecting U.S. federal taxes and administering the Internal Revenue Code, the main body of the federal statutory tax ...
, have been used to glean sensitive data from U.S. taxpayers. While the first such examples were sent indiscriminately in the expectation that some would be received by customers of a given bank or service, recent research has shown that phishers may in principle be able to determine which banks potential victims use, and target bogus emails accordingly. **
Social networking sites A social networking service or SNS (sometimes called a social networking site) is an online platform which people use to build social networks or social relationships with other people who share similar personal or career content, interests, act ...
are a prime target of phishing, since the personal details in such sites can be used in
identity theft Identity theft occurs when someone uses another person's personal identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes. The term ''identity theft'' was co ...
; in late 2006 a
computer worm A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It w ...
took over pages on MySpace and altered links to direct surfers to websites designed to steal login details. * 2007 ** 3.6 million adults lost in the 12 months ending in August 2007. Microsoft claims these estimates are grossly exaggerated and puts the annual phishing loss in the US at . ** Attackers who broke into
TD Ameritrade TD Ameritrade is a stockbroker that offers an electronic trading platform for the trade of financial assets including common stocks, preferred stocks, futures contracts, exchange-traded funds, forex, option (finance), options, mutual funds, fixed ...
's database and took 6.3 million email addresses (though they were not able to obtain
social security number In the United States, a Social Security number (SSN) is a nine-digit number issued to U.S. citizens, permanent residents, and temporary (working) residents under section 205(c)(2) of the Social Security Act, codified as . The number is issued t ...
s, account numbers, names, addresses, dates of birth, phone numbers and trading activity) also wanted the account usernames and passwords, so they launched a follow-up spear phishing attack. * 2008 ** The
RapidShare RapidShare was an online file hosting service that opened in 2002. In 2009, it was among the Internet's 20 most visited websites and claimed to have 10 petabytes of files uploaded by users with the ability to handle up to three million users sim ...
file sharing site has been targeted by phishing to obtain a premium account, which removes speed caps on downloads, auto-removal of uploads, waits on downloads, and cool down times between uploads. ** Cryptocurrencies such as Bitcoin facilitate the sale of malicious software, making transactions secure and anonymous. * 2009 ** In January 2009, a phishing attack resulted in unauthorized wire transfers of US$1.9 million through Experi-Metal's online banking accounts. ** In the third quarter of 2009, the Anti-Phishing Working Group reported receiving 115,370 phishing email reports from consumers with US and China hosting more than 25% of the phishing pages each.


2010s

* 2011 ** In March 2011, Internal RSA staff were successfully phished, leading to the master keys for all RSA SecureID security tokens being stolen, then subsequently used to break into US defense suppliers. ** Chinese phishing campaigns targeted Gmail accounts of highly ranked officials of the United States and South Korean governments and militaries, as well as Chinese political activists. * 2012 ** According to Ghosh, there were "445,004 attacks in 2012 as compared to 258,461 in 2011 and 187,203 in 2010”. * 2013 ** In August 2013, advertising service
Outbrain Outbrain is a web recommendation platform founded in 2006 by Co-Founder and Co-CEO Yaron Galai and Co-Founder, Chief Technology Officer and General Manager, Ori Lahav. The company is headquartered in New York City. The company generates revenue f ...
suffered a spear-phishing attack and SEA placed redirects into the websites of The Washington Post, Time, and CNN. ** In October 2013, emails purporting to be from American Express were sent to an unknown number of recipients. ** In November 2013, 110 million customer and credit card records were stolen from
Target Target may refer to: Physical items * Shooting target, used in marksmanship training and various shooting sports ** Bullseye (target), the goal one for which one aims in many of these sports ** Aiming point, in field artillery, ...
customers, through a phished subcontractor account. CEO and IT security staff subsequently fired. ** By December 2013,
Cryptolocker The CryptoLocker ransomware attack was a cyberattack using the ''CryptoLocker'' ransomware that occurred from 5 September 2013 to late May 2014. The attack utilized a trojan that targeted computers running Microsoft Windows, and was believed t ...
ransomware had infected 250,000 computers. According to Dell SecureWorks, 0.4% or more of those infected likely agreed to the ransom demand. * 2014 ** In January 2014, the Seculert Research Lab identified a new targeted attack that used Xtreme
RAT Rats are various medium-sized, long-tailed rodents. Species of rats are found throughout the order Rodentia, but stereotypical rats are found in the genus ''Rattus''. Other rat genera include ''Neotoma'' (pack rats), ''Bandicota'' ( bandicoot ...
. This attack used spear phishing emails to target Israeli organizations and deploy the piece of advanced malware. Fifteen machines were compromised including ones belonging to the Civil Administration of Judea and Samaria. ** In August 2014, the
iCloud leaks of celebrity photos On August 31, 2014, a collection of nearly five hundred private pictures of various celebrities, mostly women, with many containing nudity, were posted on the imageboard 4chan, and quickly disseminated by other users on websites and social netwo ...
was found to be based on phishing e-mails sent to the victims that looked like they came from Apple or Google, warning the victims that their accounts might be compromised and asking for their account details. ** In November 2014, phishing attacks on
ICANN The Internet Corporation for Assigned Names and Numbers (ICANN ) is an American multistakeholder group and nonprofit organization responsible for coordinating the maintenance and procedures of several databases related to the namespaces ...
gained administrative access to the Centralized Zone Data System; also gained was data about users in the system - and access to ICANN's public Governmental Advisory Committee wiki, blog, and whois information portal. * 2015 ** Charles H. Eccleston pleaded guilty in an attempted spear-phishing when he attempted to infect computers of 80 Department of Energy employees. **
Eliot Higgins Eliot Ward Higgins (born January 1979), who previously wrote under the pseudonym Brown Moses, is a British citizen journalist and former blogger, known for using open sources and social media for investigations. He is the founder of Bellingcat, ...
and other journalists associated with Bellingcat, a group researching the shootdown of
Malaysia Airlines Flight 17 Malaysia Airlines Flight 17 (MH17/MAS17) was a scheduled passenger flight from Amsterdam to Kuala Lumpur that was shot down by Russian forces on 17 July 2014, while flying over eastern Ukraine. All 283 passengers and 15 crew were killed. Con ...
over Ukraine, were targeted by numerous spear phishing emails. ** In August 2015, Cozy Bear was linked to a
spear-phishing Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...
cyber-attack A cyberattack is any offensive maneuver that targets computer information systems, computer networks, infrastructures, or personal computer devices. An attacker is a person or process that attempts to access data, functions, or other restricte ...
against the
Pentagon In geometry, a pentagon (from the Greek πέντε ''pente'' meaning ''five'' and γωνία ''gonia'' meaning ''angle'') is any five-sided polygon or 5-gon. The sum of the internal angles in a simple pentagon is 540°. A pentagon may be simp ...
email Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronic (digital) version of, or counterpart to, mail, at a time when "mail" meant ...
system causing the shut down of the entire Joint Staff unclassified email system and Internet access during the investigation. ** In August 2015, Fancy Bear used a zero-day exploit of
Java Java (; id, Jawa, ; jv, ꦗꦮ; su, ) is one of the Greater Sunda Islands in Indonesia. It is bordered by the Indian Ocean to the south and the Java Sea to the north. With a population of 151.6 million people, Java is the world's most ...
, in a spear phishing attack spoofing the
Electronic Frontier Foundation The Electronic Frontier Foundation (EFF) is an international non-profit digital rights group based in San Francisco, California. The foundation was formed on 10 July 1990 by John Gilmore, John Perry Barlow and Mitch Kapor to promote Internet civ ...
and launching attacks on the
White House The White House is the official residence and workplace of the president of the United States. It is located at 1600 Pennsylvania Avenue NW in Washington, D.C., and has been the residence of every U.S. president since John Adams in 1800 ...
and
NATO The North Atlantic Treaty Organization (NATO, ; french: Organisation du traité de l'Atlantique nord, ), also called the North Atlantic Alliance, is an intergovernmental military alliance between 30 member states – 28 European and two Nor ...
. * 2016 * In February, Austrian aerospace firm FACC AG was defrauded of 42 million euros ($47 million) through a
BEC BEC may refer to: As an acronym House * Bapatla Engineering College * Basaveshwar Engineering College * Bengal Engineering College Curriculum * Business Environment and Concepts, a section of Uniform Certified Public Accountant Examination * B ...
attack - and subsequently fired both the CFO and CEO. ** Fancy Bear carried out spear phishing attacks on email addresses associated with the Democratic National Committee in the first quarter of 2016. **
The Wichita Eagle ''The Wichita Eagle'' is a daily newspaper published in Wichita, Kansas, United States. It is owned by The McClatchy Company and is the largest newspaper in Wichita and the surrounding area. History Origins In 1870, ''The Vidette'' was the fi ...
reported " KU employees fall victim to phishing scam, lose paychecks" **
Fancy Bear Fancy Bear (also known as APT28 (by Mandiant), Pawn Storm, Sofacy Group (by Kaspersky), Sednit, Tsar Team (by FireEye) and STRONTIUM (by Microsoft)) is a Russian cyber espionage group. Cybersecurity firm CrowdStrike has said with a medium level ...
is suspected to be behind a spear phishing attack in August 2016 on members of the
Bundestag The Bundestag (, "Federal Diet") is the German federal parliament. It is the only federal representative body that is directly elected by the German people. It is comparable to the United States House of Representatives or the House of Commons ...
and multiple political parties such as Linken-faction leader
Sahra Wagenknecht Sahra Wagenknecht (born Sarah Wagenknecht; ; 16 July 1969) is a German politician, economist, author and publicist. Since 2009, she has been a member of the Bundestag for The Left. From 2015 to 2019 she served as parliamentary co-chair of her pa ...
,
Junge Union The Junge Union Deutschlands (''Young Union of Germany'') or JU is the joint youth organisation of the two conservative German political parties, CDU and CSU. Membership is limited to individuals between 14 and 35 years of age. Junge Union cla ...
and the CDU of
Saarland The Saarland (, ; french: Sarre ) is a state of Germany in the south west of the country. With an area of and population of 990,509 in 2018, it is the smallest German state in area apart from the city-states of Berlin, Bremen, and Hamburg, and ...
. ** In August 2016, the
World Anti-Doping Agency The World Anti-Doping Agency (WADA; french: Agence mondiale antidopage, AMA) is a foundation initiated by the International Olympic Committee based in Canada to promote, coordinate, and monitor the fight against drugs in sports. The agency's key ...
reported the receipt of phishing emails sent to users of its database claiming to be official WADA, but consistent with the Russian hacking group Fancy Bear. According to WADA, some of the data the hackers released had been forged. ** Within hours of the 2016 U.S. election results, Russian hackers sent emails from spoofed
Harvard University Harvard University is a private Ivy League research university in Cambridge, Massachusetts. Founded in 1636 as Harvard College and named for its first benefactor, the Puritan clergyman John Harvard, it is the oldest institution of higher le ...
email addresses, using techniques similar to phishing to publish
fake news Fake news is false or misleading information presented as news. Fake news often has the aim of damaging the reputation of a person or entity, or making money through advertising revenue.Schlesinger, Robert (April 14, 2017)"Fake news in reality ...
targeted at ordinary American voters. * 2017 ** In 2017, 76% of organizations experienced phishing attacks. Nearly half of information security professionals surveyed said that the rate of attacks increased from 2016. ** In the first half of 2017 businesses and residents of Qatar were hit with more than 93,570 phishing events in a three-month span. ** A phishing email to Google and Facebook users successfully induced employees into wiring money – to the extent of US$100 million – to overseas bank accounts under the control of a hacker. He has since been arrested by the US Department of Justice. ** In August 2017, customers of Amazon faced the Amazon Prime Day phishing attack, when hackers sent out seemingly legitimate deals to customers of Amazon. When Amazon's customers attempted to make purchases using the "deals", the transaction would not be completed, prompting the retailer's customers to input data that could be compromised and stolen. * 2018 ** In 2018, the company block.one, which developed the EOS.IO blockchain, was attacked by a phishing group who sent phishing emails to all customers, aimed at intercepting the user's cryptocurrency wallet key; and a later attack targeted airdrop tokens. * 2019 ** Between May 30, 2019 and October 6, 2019 an unauthorized individual gained access to employee email accounts at Golden Entertainment, a Las Vegas, Nevada slot machine operator using an email phishing attack. The attacker had access to one particular email with an attachment containing the
Social Security Number In the United States, a Social Security number (SSN) is a nine-digit number issued to U.S. citizens, permanent residents, and temporary (working) residents under section 205(c)(2) of the Social Security Act, codified as . The number is issued t ...
s,
Passport A passport is an official travel document issued by a government that contains a person's identity. A person with a passport can travel to and from foreign countries more easily and access consular assistance. A passport certifies the persona ...
numbers, government IDs, and various personal data of multiple company employees and vendors. It is unclear whether this information was exposed. The company notified all affected individuals as a precaution, offering them complimentary Credit report monitoring. Subsequently, a class action lawsuit against the company was approved in the
United States District Court for the District of Nevada United may refer to: Places * United, Pennsylvania, an unincorporated community * United, West Virginia, an unincorporated community Arts and entertainment Films * ''United'' (2003 film), a Norwegian film * ''United'' (2011 film), a BBC Two fi ...
on December 17, 2020. ** From 2015-2019, Unatrac Holding Ltd. was subjected to an ongoing spear phishing attack, costing about $11 million US dollars. Obinwanne Okeke and conspirators first acquired the company CFO's email credentials. Then, they sent fake invoices and wire transfer requests to the company's financial department. Okeke perpetrated cyberfraud against many other businesses and individuals, successfully capturing email and other sensitive login credentials. On February 16, 2021, he was sentenced to 10 years in prison.


2020s

* 2020 ** On July 15, 2020,
Twitter Twitter is an online social media and social networking service owned and operated by American company Twitter, Inc., on which users post and interact with 280-character-long messages known as "tweets". Registered users can post, like, an ...
suffered a breach that combined elements of
Social engineering (security) Social engineering may refer to: * Social engineering (political science), a means of influencing particular attitudes and social behaviors on a large scale * Social engineering (security), obtaining confidential information by manipulating and/or ...
and phishing. A 17-year old hacker and accomplices setup a fake website resembling Twitter's internal VPN provider used by
remote work Remote work, also called work from home (WFH), work from anywhere, telework, remote job, mobile work, and distance work is an employment arrangement in which employees do not commute to a central place of work, such as an office building, war ...
ing employees. Individuals posing as helpdesk staff called multiple Twitter employees, directing them to submit their credentials to the fake VPN website. Using the details supplied by the unknowing employees, they were then able to seize control of several high-profile user accounts, including
Barack Obama Barack Hussein Obama II ( ; born August 4, 1961) is an American politician who served as the 44th president of the United States from 2009 to 2017. A member of the Democratic Party, Obama was the first African-American president of the U ...
,
Elon Musk Elon Reeve Musk ( ; born June 28, 1971) is a business magnate and investor. He is the founder, CEO and chief engineer of SpaceX; angel investor, CEO and product architect of Tesla, Inc.; owner and CEO of Twitter, Inc.; founder of The B ...
, Joe Biden and
Apple Inc. Apple Inc. is an American multinational technology company headquartered in Cupertino, California, United States. Apple is the largest technology company by revenue (totaling in 2021) and, as of June 2022, is the world's biggest company b ...
's company account. The hackers sent messages to Twitter followers soliciting Bitcoin promising double the transaction value in return, collecting 12.86 BTC (about $117,000 at the time).


Anti-phishing

There are anti-phishing websites which publish exact messages that have been recently circulating the internet, such as FraudWatch International and Millersmiles. Such sites often provide specific details about the particular messages. As recently as 2007, the adoption of anti-phishing strategies by businesses needing to protect personal and financial information was low. Now there are several different techniques to combat phishing, including legislation and technology created specifically to protect against phishing. These techniques include steps that can be taken by individuals, as well as by organizations. Phone, web site, and email phishing can now be reported to authorities, as described
below Below may refer to: *Earth * Ground (disambiguation) *Soil *Floor * Bottom (disambiguation) *Less than *Temperatures below freezing *Hell or underworld People with the surname *Ernst von Below (1863–1955), German World War I general *Fred Below ...
.


User training

People can be trained to recognize phishing attempts, and to deal with them through a variety of approaches. Such education can be effective, especially where training emphasizes conceptual knowledge and provides direct feedback. Therefore, an essential part of any organization or institutions anti-phishing strategy is to actively educate its users so that they can identify phishing scams without hesitation and act accordingly. Although there is currently a lack of data and recorded history that shows educational guidance and other information-based interventions successfully reduce susceptibility to phishing, large amounts of information regarding the phishing threat are available on the Internet. Many organizations run regular simulated phishing campaigns targeting their staff to measure the effectiveness of their training. For example, this often occurs in the healthcare industry due to the fact that healthcare data has significant value as a potential target for hackers. In a recent study done by the National Library of Medicine an assessment was performed as part of cybersecurity activity during a designated test period using multiple credential harvesting approaches through staff email. During the 1-month testing period, the organization received 858 200 emails: 139 400 (16%) marketing, 18 871 (2%) identified as potential threats. This is just one example of the many steps being taken to combat phishing within healthcare. People can take steps to avoid phishing attempts by slightly modifying their browsing habits. When contacted about an account needing to be "verified" (or any other topic used by phishers), it is a sensible precaution to contact the company from which the email apparently originates to check that the email is legitimate. Alternatively, the address that the individual knows is the company's genuine website can be typed into the address bar of the browser, rather than trusting any
hyperlink In computing, a hyperlink, or simply a link, is a digital reference to data that the user can follow or be guided by clicking or tapping. A hyperlink points to a whole document or to a specific element within a document. Hypertext is text wi ...
s in the suspected phishing message. Nearly all legitimate e-mail messages from companies to their customers contain an item of information that is not readily available to phishers. Some companies, for example
PayPal PayPal Holdings, Inc. is an American multinational financial technology company operating an online payments system in the majority of countries that support online money transfers, and serves as an electronic alternative to traditional paper ...
, always address their customers by their username in emails, so if an email addresses the recipient in a generic fashion ("''Dear PayPal customer''") it is likely to be an attempt at phishing. Furthermore, PayPal offers various methods to determine spoof emails and advises users to forward suspicious emails to their [email protected] domain to investigate and warn other customers. However it is unsafe to assume that the presence of personal information alone guarantees that a message is legitimate, and some studies have shown that the presence of personal information does not significantly affect the success rate of phishing attacks; which suggests that most people do not pay attention to such details. Emails from banks and credit card companies often include partial account numbers. However, recent research has shown that the public do not typically distinguish between the first few digits and the last few digits of an account number—a significant problem since the first few digits are often the same for all clients of a financial institution. The Anti-Phishing Working Group, who's one of the largest anti-phishing organizations in the world, produces regular report on trends in phishing attacks. Google posted a video demonstrating how to identify and protect yourself from Phishing scams.


Technical approaches

A wide range of technical approaches are available to prevent phishing attacks reaching users or to prevent them from successfully capturing sensitive information.


Filtering out phishing mail

Specialized spam filters can reduce the number of phishing emails that reach their addressees' inboxes. These filters use a number of techniques including
machine learning Machine learning (ML) is a field of inquiry devoted to understanding and building methods that 'learn', that is, methods that leverage data to improve performance on some set of tasks. It is seen as a part of artificial intelligence. Machin ...
and
natural language processing Natural language processing (NLP) is an interdisciplinary subfield of linguistics, computer science, and artificial intelligence concerned with the interactions between computers and human language, in particular how to program computers to proc ...
approaches to classify phishing emails, and reject email with forged addresses.


Browsers alerting users to fraudulent websites

Another popular approach to fighting phishing is to maintain a list of known phishing sites and to check websites against the list. One such service is the Safe Browsing service. Web browsers such as
Google Chrome Google Chrome is a cross-platform web browser developed by Google. It was first released in 2008 for Microsoft Windows, built with free software components from Apple WebKit and Mozilla Firefox. Versions were later released for Linux, macOS, ...
,
Internet Explorer Internet Explorer (formerly Microsoft Internet Explorer and Windows Internet Explorer, commonly abbreviated IE or MSIE) is a series of graphical user interface, graphical web browsers developed by Microsoft which was used in the Microsoft Wind ...
7,
Mozilla Firefox Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation. It uses the Gecko rendering engine to display web pages, which implements current an ...
2.0,
Safari A safari (; ) is an overland journey to observe wild animals, especially in eastern or southern Africa. The so-called "Big Five" game animals of Africa – lion, leopard, rhinoceros, elephant, and Cape buffalo – particularly form an impor ...
3.2, and
Opera Opera is a form of theatre in which music is a fundamental component and dramatic roles are taken by singers. Such a "work" (the literal translation of the Italian word "opera") is typically a collaboration between a composer and a libre ...
all contain this type of anti-phishing measure.
Firefox 2 Mozilla Firefox 2 is a version of Firefox, a web browser released on October 24, 2006 by the Mozilla Corporation. Firefox 2 uses version 1.8 of the Gecko layout engine for displaying web pages. The release contained many new features not found ...
used
Google Google LLC () is an American multinational technology company focusing on search engine technology, online advertising, cloud computing, computer software, quantum computing, e-commerce, artificial intelligence, and consumer electronics. I ...
anti-phishing software. Opera 9.1 uses live blacklists from
Phishtank PhishTank is an anti-phishing site. PhishTank was launched in October 2006 by entrepreneur David Ulevitch as an offshoot of OpenDNS. The company offers a community-based phish verification system where users submit suspected phishes and other us ...
, cyscon and
GeoTrust GeoTrust is a digital certificate provider. The GeoTrust brand was bought by Symantec from Verisign in 2010, but agreed to sell the certificate business (including GeoTrust) in August 2017 to private equity and growth capital firm Thoma Bravo L ...
, as well as live
whitelist A whitelist, allowlist, or passlist is a mechanism which explicitly allows some identified entities to access a particular privilege, service, mobility, or recognition i.e. it is a list of things allowed when everything is denied by default. It i ...
s from GeoTrust. Some implementations of this approach send the visited URLs to a central service to be checked, which has raised concerns about privacy. According to a report by Mozilla in late 2006, Firefox 2 was found to be more effective than
Internet Explorer 7 Windows Internet Explorer 7 (IE7) (codenamed Rincon) is a web browser for Windows. It was released by Microsoft on October 18, 2006, as the seventh version of Internet Explorer and the successor to Internet Explorer 6. Internet Explorer 7 is par ...
at detecting fraudulent sites in a study by an independent software testing company. An approach introduced in mid-2006 involves switching to a special DNS service that filters out known phishing domains: this will work with any browser, and is similar in principle to using a
hosts file The computer file hosts is an operating system file that maps hostnames to IP addresses. It is a plain text file. Originally a file named HOSTS.TXT was manually maintained and made available via file sharing by Stanford Research Institute for th ...
to block web adverts. To mitigate the problem of phishing sites impersonating a victim site by embedding its images (such as logos), several site owners have altered the images to send a message to the visitor that a site may be fraudulent. The image may be moved to a new filename and the original permanently replaced, or a server can detect that the image was not requested as part of normal browsing, and instead send a warning image.


Augmenting password logins

The Bank of America website is one of several that asks users to select a personal image (marketed as SiteKey) and displays this user-selected image with any forms that request a password. Users of the bank's online services are instructed to enter a password only when they see the image they selected. However, several studies suggest that few users refrain from entering their passwords when images are absent. In addition, this feature (like other forms of
two-factor authentication Multi-factor authentication (MFA; encompassing two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting ...
) is susceptible to other attacks, such as those suffered by Scandinavian bank
Nordea Nordea Bank Abp, commonly referred to as Nordea, is a European financial services group operating in northern Europe and based in Helsinki, Finland. The name is a blend of the words "Nordic" and "idea". The bank is the result of the successive ...
in late 2005, and
Citibank Citibank, N. A. (N. A. stands for " National Association") is the primary U.S. banking subsidiary of financial services multinational Citigroup. Citibank was founded in 1812 as the City Bank of New York, and later became First National City Ba ...
in 2006. A similar system, in which an automatically generated "Identity Cue" consisting of a colored word within a colored box is displayed to each website user, is in use at other financial institutions. Security skins are a related technique that involves overlaying a user-selected image onto the login form as a visual cue that the form is legitimate. Unlike the website-based image schemes, however, the image itself is shared only between the user and the browser, and not between the user and the website. The scheme also relies on a
mutual authentication Mutual authentication or two-way authentication (not to be confused with two-factor authentication) refers to two parties authenticating each other at the same time in an authentication protocol. It is a default mode of authentication in some prot ...
protocol, which makes it less vulnerable to attacks that affect user-only authentication schemes. Still another technique relies on a dynamic grid of images that is different for each login attempt. The user must identify the pictures that fit their pre-chosen categories (such as dogs, cars and flowers). Only after they have correctly identified the pictures that fit their categories are they allowed to enter their alphanumeric password to complete the login. Unlike the static images used on the Bank of America website, a dynamic image-based authentication method creates a one-time passcode for the login, requires active participation from the user, and is very difficult for a phishing website to correctly replicate because it would need to display a different grid of randomly generated images that includes the user's secret categories.


Monitoring and takedown

Several companies offer banks and other organizations likely to suffer from phishing scams round-the-clock services to monitor, analyze and assist in shutting down phishing websites. Automated detection of phishing content is still below accepted levels for direct action, with content-based analysis reaching between 80% and 90% of success so most of the tools include manual steps to certify the detection and authorize the response. Individuals can contribute by reporting phishing to both volunteer and industry groups, such as cyscon or
PhishTank PhishTank is an anti-phishing site. PhishTank was launched in October 2006 by entrepreneur David Ulevitch as an offshoot of OpenDNS. The company offers a community-based phish verification system where users submit suspected phishes and other us ...
. Phishing web pages and emails can be reported to Google.


Transaction verification and signing

Solutions have also emerged using the mobile phone (smartphone) as a second channel for verification and authorization of banking transactions.


Multi-factor authentication

Organizations can implement two factor or
multi-factor authentication Multi-factor authentication (MFA; encompassing two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting ...
(MFA), which requires a user to use at least 2 factors when logging in. (For example, a user must both present a
smart card A smart card, chip card, or integrated circuit card (ICC or IC card) is a physical electronic authentication device, used to control access to a resource. It is typically a plastic credit card-sized card with an embedded integrated circuit (IC) c ...
and a
password A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
). This mitigates some risk, in the event of a successful phishing attack, the stolen password on its own cannot be reused to further breach the protected system. However, there are several attack methods which can defeat many of the typical systems. MFA schemes such as
WebAuthn Web Authentication (WebAuthn) is a web standard published by the World Wide Web Consortium (W3C). WebAuthn is a core component of the FIDO2 Project under the guidance of the FIDO Alliance. The goal of the project is to standardize an interface fo ...
address this issue by design.


Email content redaction

Organizations that prioritize security over convenience can require users of its computers to use an email client that redacts URLs from email messages, thus making it impossible for the reader of the email to click on a link, or even copy a URL. While this may result in an inconvenience, it does almost eliminate email phishing attacks.


Limitations of technical responses

An article in ''
Forbes ''Forbes'' () is an American business magazine owned by Integrated Whale Media Investments and the Forbes family. Published eight times a year, it features articles on finance, industry, investing, and marketing topics. ''Forbes'' also rep ...
'' in August 2014 argues that the reason phishing problems persist even after a decade of anti-phishing technologies being sold is that phishing is "a technological medium to exploit human weaknesses" and that technology cannot fully compensate for human weaknesses.


Legal responses

On January 26, 2004, the U.S.
Federal Trade Commission The Federal Trade Commission (FTC) is an independent agency of the United States government whose principal mission is the enforcement of civil (non-criminal) antitrust law and the promotion of consumer protection. The FTC shares jurisdiction ov ...
filed the first lawsuit against a suspected phisher. The defendant, a Californian teenager, allegedly created a webpage designed to look like the
America Online AOL (stylized as Aol., formerly a company known as AOL Inc. and originally known as America Online) is an American web portal and online service provider based in New York City. It is a brand marketed by the current incarnation of Yahoo (2017� ...
website, and used it to steal credit card information. Other countries have followed this lead by tracing and arresting phishers. A phishing kingpin, Valdir Paulo de Almeida, was arrested in Brazil for leading one of the largest phishing crime rings, which in two years stole between and . UK authorities jailed two men in June 2005 for their role in a phishing scam, in a case connected to the
U.S. Secret Service The United States Secret Service (USSS or Secret Service) is a federal law enforcement agency under the Department of Homeland Security charged with conducting criminal investigations and protecting U.S. political leaders, their families, and ...
Operation Firewall, which targeted notorious "carder" websites. In 2006 eight people were arrested by Japanese police on suspicion of phishing fraud by creating bogus Yahoo Japan Web sites, netting themselves (). The arrests continued in 2006 with the
FBI The Federal Bureau of Investigation (FBI) is the domestic intelligence and security service of the United States and its principal federal law enforcement agency. Operating under the jurisdiction of the United States Department of Justice, t ...
Operation Cardkeeper detaining a gang of sixteen in the U.S. and Europe. In the
United States The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territo ...
,
Senator A senate is a deliberative assembly, often the upper house or chamber of a bicameral legislature. The name comes from the ancient Roman Senate (Latin: ''Senatus''), so-called as an assembly of the senior (Latin: ''senex'' meaning "the ...
Patrick Leahy Patrick Joseph Leahy (; born March 31, 1940) is an American politician and attorney who is the senior United States senator from Vermont and serves as the president pro tempore of the United States Senate. A member of the Democratic Party, Le ...
introduced the Anti-Phishing Act of 2005 in
Congress A congress is a formal meeting of the representatives of different countries, constituent states, organizations, trade unions, political parties, or other groups. The term originated in Late Middle English to denote an encounter (meeting of ...
on March 1, 2005. This bill, if it had been enacted into law, would have subjected criminals who created fake web sites and sent bogus emails in order to defraud consumers to fines of up to and prison terms of up to five years. The UK strengthened its legal arsenal against phishing with the
Fraud Act 2006 The Fraud Act 2006 (c 35) is an Act of the Parliament of the United Kingdom which affects England and Wales and Northern Ireland. It was given royal assent on 8 November 2006, and came into effect on 15 January 2007. Purpose The Act gives a sta ...
, which introduces a general offence of fraud that can carry up to a ten-year prison sentence, and prohibits the development or possession of phishing kits with intent to commit fraud. Companies have also joined the effort to crack down on phishing. On March 31, 2005,
Microsoft Microsoft Corporation is an American multinational technology corporation producing computer software, consumer electronics, personal computers, and related services headquartered at the Microsoft Redmond campus located in Redmond, Washingt ...
filed 117 federal lawsuits in the
U.S. District Court for the Western District of Washington The United States District Court for the Western District of Washington (in case citations, W.D. Wash.) is the federal district court whose jurisdiction comprises the following counties of the state of Washington: Clallam, Clark, Cowlitz, Gray ...
. The lawsuits accuse "
John Doe John Doe (male) and Jane Doe (female) are multiple-use placeholder names that are used when the true name of a person is unknown or is being intentionally concealed. In the context of law enforcement in the United States, such names are ofte ...
" defendants of obtaining passwords and confidential information. March 2005 also saw a partnership between Microsoft and the
Australian government The Australian Government, also known as the Commonwealth Government, is the national government of Australia, a federal parliamentary constitutional monarchy. Like other Westminster-style systems of government, the Australian Government ...
teaching law enforcement officials how to combat various cyber crimes, including phishing. Microsoft announced a planned further 100 lawsuits outside the U.S. in March 2006, followed by the commencement, as of November 2006, of 129 lawsuits mixing criminal and civil actions.
AOL AOL (stylized as Aol., formerly a company known as AOL Inc. and originally known as America Online) is an American web portal and online service provider based in New York City. It is a brand marketed by the current incarnation of Yahoo! Inc. ...
reinforced its efforts against phishing in early 2006 with three lawsuits seeking a total of under the 2005 amendments to the Virginia Computer Crimes Act, and
Earthlink EarthLink is an American Internet service provider. It went public on NASDAQ in January 1997. Much of the company's growth was via acquisition; by 2000, ''The New York Times'' described Earthlink as the "second largest Internet service provider ...
has joined in by helping to identify six men subsequently charged with phishing fraud in Connecticut. In January 2007, Jeffrey Brett Goodin of California became the first defendant convicted by a jury under the provisions of the
CAN-SPAM Act of 2003 The Controlling the Assault of Non-Solicited Pornography And Marketing (CAN-SPAM) Act of 2003 is a law passed in 2003 establishing the United States' first national standards for the sending of commercial e-mail. The law requires the Federal Trad ...
. He was found guilty of sending thousands of emails to America Online (AOL) users, while posing as AOL's billing department, which prompted customers to submit personal and credit card information. Facing a possible 101 years in prison for the CAN-SPAM violation and ten other counts including
wire fraud Mail fraud and wire fraud are terms used in the United States to describe the use of a physical or electronic mail system to defraud another, and are federal crimes there. Jurisdiction is claimed by the federal government if the illegal activit ...
, the unauthorized use of credit cards, and the misuse of AOL's trademark, he was sentenced to serve 70 months. Goodin had been in custody since failing to appear for an earlier court hearing and began serving his prison term immediately.


Notable incidents

* 2016–2021 literary phishing thefts


See also

* * *
Catfishing Catfishing is a deceptive activity in which a person creates a fictional persona or fake identity on a social networking service, usually targeting a specific victim. The practice may be used for financial gain, to compromise a victim in som ...
* Clickjacking * * *
Link farm On the World Wide Web, a link farm is any group of websites that all hyperlink to other sites in the group for the purpose of increasing SEO rankings. In graph theoretic terms, a link farm is a clique. Although some link farms can be created ...
* , many abusable by phishing * Mousetrapping * * *
Trojan Horse The Trojan Horse was a wooden horse said to have been used by the Greeks during the Trojan War to enter the city of Troy and win the war. The Trojan Horse is not mentioned in Homer's ''Iliad'', with the poem ending before the war is concluded, ...
*
TrustRank TrustRank is an algorithm that conducts link analysis to separate useful webpages from spam and helps search engine rank pages in SERPs (Search Engine Results Pages). It is semi-automated process which means that it needs some human assistance ...
*


References


External links


Anti-Phishing Working Group

Center for Identity Management and Information Protection
Utica College Utica University is a private university in Utica, New York. The university dates back to the 1930s when Syracuse University began offering extension courses in the Utica area. In 2016, the university enrolled 3,084 undergraduate students and ...

Plugging the "phishing" hole: legislation versus technology
– '' Duke Law & Technology Review''
Example of a Phishing Attempt with Screenshots and Explanations
– StrategicRevenue.com
A Profitless Endeavor: Phishing as Tragedy of the Commons
– Microsoft Corporation
Database for information on phishing sites reported by the public
PhishTank PhishTank is an anti-phishing site. PhishTank was launched in October 2006 by entrepreneur David Ulevitch as an offshoot of OpenDNS. The company offers a community-based phish verification system where users submit suspected phishes and other us ...

The Impact of Incentives on Notice and Take-down
− Computer Laboratory, University of Cambridge (PDF, 344 kB) {{Authority control Internet terminology Organized crime activity Social engineering (computer security) Spamming Cybercrime Confidence tricks Identity theft Types of cyberattacks Deception Fraud