Understanding How Phishing Scams Stay Relevant and Thrive

Phishing scams have been around for a long time, but they continue to evolve and thrive. This is because scammers are constantly coming up with new tactics to trick people into giving them their personal and financial information.

According to some reports, phishing scams have resulted in billions of dollars in losses worldwide. This is a staggering number that highlights the severity of the problem.

Phishers are getting more sophisticated, using fake websites that look identical to real ones to lure victims in. They also use social engineering tactics to create a sense of urgency and panic, making people more likely to fall for their scams.

Scammers are also using AI-powered tools to create more convincing emails and messages, making it harder for people to spot the fake ones.

Broaden your view: Fake Microsoft Security Warning Email

Phishing scams have been a persistent threat since the mid-1990s. They've been around for a long time.

Phishers adapt their strategies to exploit new tools and vulnerabilities, making their attacks smarter, more targeted, and increasingly difficult to detect. This is especially true with the advent of AI technology.

Smishing, vishing, and other spin-off attacks have been observed, using mediums like text messages and audio scams. These attacks are becoming more sophisticated.

The takeover of dozens of high-profile Twitter accounts in July 2020 was possible due to a sophisticated vishing campaign targeting Twitter employees. This shows how phishing scams can be used to gain access to sensitive information.

As technology continues to advance, phishers will likely find new ways to exploit vulnerabilities and stay relevant.

Check this out: Phishing Vishing and Smishing

Criminal organizations have a significant advantage when it comes to funding, which they use to invest in technical resources to make their scams more efficient.

Cybercriminals have plenty of funds to invest in scams, thanks to their massive success in recent years. This has enabled them to branch out into new attack vectors, such as social media.

The availability of phishing kits and ransomware-as-a-service has made it easy for amateur cybercriminals to enter the market and compete with sophisticated criminal organizations.

Low-cost phishing and ransomware tools are easy to get hold of, which has led to a growing trend of people with little or no IT experience reaping the rewards of these tools.

Even people with little or no IT experience are using these tools, which is a worrying trend given the lucrative earning potential they offer.

Phishing attacks come in various forms, each with its own unique approach. Bulk phishing is a classic attack that casts a wide net, hoping to snag a few victims out of millions.

Bulk phishers often use low-complexity methods and easily available "phishing kits" to carry out their attacks. This makes them relatively easy to set up.

Smishing and vishing are spin-off attacks that use text messages and audio scams to trick victims. Smishing sends phishing messages via SMS, while vishing uses recorded or live audio to deceive.

Bulk attacks are a type of phishing that casts a wide net to catch as many victims as possible. They often have a low overall success rate, but rely on the fact that a few people will fall for the bait.

Bulk phishers may use an easily available "phishing kit" to carry out their attacks. These kits can be found online and are often low in complexity.

Bulk phishing campaigns are designed to be simple and easy to execute, making them a popular choice for attackers. They can be carried out quickly and with minimal effort.

The success of bulk attacks relies on the sheer volume of potential victims. With thousands or even millions of people targeted, a few will inevitably take the bait.

Spear whaling is a type of phishing attack that targets high-level individuals, such as executives or influencers, with the goal of convincing them to reveal sensitive information.

These attackers perform in-depth research to accurately impersonate senior management, using their authority to convince employees to comply with requests.

IT administrators and HR professionals are frequent targets because of their level of access within the organization.

Attackers may impersonate CEOs, CFOs, or heads of HR to convince employees to reveal sensitive information.

A successful whaling excursion requires attackers to convincingly impersonate their target, making it a more challenging and sophisticated type of phishing attack.

Smishing attacks are a type of phishing that takes place over text message (SMS). These attacks can be very convincing and are often used to trick people into giving away sensitive information.

A spin-off of phishing, vishing attacks swap the text message for an audio scam, either live or recorded. This type of attack was used in a sophisticated campaign that took over dozens of high-profile Twitter accounts in July 2020.

Phishing attacks still remain the most common type of attack, with most taking place over email.

Social media platforms were the most frequently targeted sector in the third quarter of 2024, accounting for 30.5% of all phishing attacks.

This is consistent with the first and second quarters of the year, where social media made up 37.4% and 32.9% of all phishing attacks, respectively.

SAAS (Software as a Service), particularly Webmail, was the second most targeted sector throughout 2024, accounting for 21.2% of phishing attacks in the third quarter.

The financial sector saw a decline in phishing attacks, making up 13% of all attacks in the third quarter of 2024, down from 24.9% in the third quarter of 2023.

Financial institutions' implementation of stronger security measures, such as two-factor authentication, may have contributed to this decline.

Related reading: Social Security Administration Scam Email

Free webmail providers have become a popular target for cybercriminals, with 70% of Business Email Compromise (BEC) attacks launched using these services.

The most commonly used free webmail client in BEC attacks is Google's Gmail, accounting for 83.1% of all free email accounts set up by scammers in the third quarter of 2024.

This is a significant increase from the previous quarter, where Gmail accounted for 72.4% of all free email accounts used for BEC attacks.

Microsoft's email service comes in second, making up 9.5% of all free email accounts used for BEC attacks.

You might like: Gmail Phishing Attack

Phishing scams have been around for a while, and they still manage to trick people into handing over sensitive information. This is partly due to their cleverly crafted emails that mimic legitimate messages from companies.

A typical phishing email starts with a sense of urgency in the subject line, using intense language and scare tactics to grab your attention. This is often accompanied by a generic greeting, such as "user" or "customer", in the "To" field.

The body copy of a phishing email is usually riddled with grammar and punctuation mistakes, and it'll often try to create a sense of panic to get you to act quickly. Be wary of suspicious links that are shortened or formatted to look like a legitimate link.

Phishing emails often employ scare tactics, such as claiming your account will be suspended or that you'll be charged a fee if you don't take action. These tactics can be convincing, but they're usually just a way to get you to click on a malicious link.

Here are some common components of a phishing email:

If you click on a phishing link, you'll often be taken to a malicious landing page, which can install malware on your device or steal your sensitive information. Be cautious when clicking on links in emails, and always verify the sender's identity before taking any action.

Lack of security awareness is a major issue, with 6% of users having never received security awareness training. This lack of training makes it easier for cybercriminals to succeed.

The panic people experience when receiving phishing emails can cause them to overlook signs that the message is malicious, leading to them clicking links, opening attachments, and handing over their username and password.

Unfortunately, most users don't receive the necessary training, with 52% receiving it no more than twice per year. This lack of training makes IT departments lose confidence in their users' ability to recognise incoming threats.

Lack of security awareness is a significant issue, and it's a major reason why phishing attacks are so successful. In fact, 6% of users have never received security awareness training, which is pretty damning when it comes to an employee's confidence and ability to recognize phishing attacks and act appropriately.

Most users don't receive the necessary training, with 52% receiving training no more than twice per year. This lack of training can lead to a momentary lapse in judgment, causing people to overlook signs that a message is malicious.

A panic response to a suspicious message claiming suspicious activity on an account can cause people to click links, open attachments, and hand over their username and password. It's too late by that point, and the victim has already fallen victim to the phishing scam.

The good news is that this is a weakness that organisations and individuals have the power to address. All they have to do is learn about the way phishing works and the clues to look out for.

Here are some key statistics on the lack of security awareness:

The average time it takes for users to fall for a phishing email is just one minute. This alarming rate highlights the importance of being vigilant when checking emails.

In simulation engagements, 20% of users reported phishing in 2020, and 11% of those who clicked the email reported as well. This shows that a significant number of people are susceptible to phishing scams.

It takes users an average of 21 seconds to click on a phishing link, and an additional 28 seconds to enter their data on a phishing site. This rapid response time is a cause for concern, as it leaves little time for users to think critically about the email's legitimacy.

The overall rate of reporting phishing scams has increased over the last couple of years, according to Verizon's 2024 Data Breach Investigations Report. This trend suggests that phishing scams are becoming more prevalent and sophisticated.