Phishing

Phishing is a fake message built to trick a person into giving away a password, an OTP or money. The message pretends to come from someone the person trusts, such as a bank, a courier company, a government office or the person's own boss. It can arrive as an email, an SMS, a WhatsApp message or a phone call. A phishing SMS is sometimes called smishing, and a phishing phone call is called vishing.

Here is how it works in general. The attacker first copies the look of a trusted sender: the logo, the tone, and an email address or phone number that is almost the same as the real one. The attacker then sends the message, either to lakhs of people at once or to one chosen person. A message aimed at one chosen person, using details about that person, is called spear phishing. The message creates hurry: an account will be blocked, a parcel is held, a payment is overdue. It asks the person to click a link, type a password on a fake login page, share an OTP or send money. Whatever the person types or pays goes straight to the attacker.

Phishing aims at a person, not at a flaw in the software. So the defences are partly technical and partly human. A secure email gateway checks each message on the way in. DMARC lets a company publish a rule for mail sent in its name. Other mail servers check whether each such message came from one of the company's approved servers or carries the company's digital signature. The rule can tell them to reject a message that passes neither check, so mail forged in that name is refused. And security awareness training sends staff harmless fake phishing mail, so that they learn to stop and check. A password manager also helps, because it will not fill in a password on a look-alike address.

Take, for example, an SMS that says a home's electricity will be cut tonight unless the bill is paid at a link. Caller ID and spam blocking apps warn about such messages from numbers that many people have already reported.

Consider an accounts executive at a manufacturing company who receives an email that seems to come from the managing director, asking for an urgent transfer to a new supplier. This kind of phishing is called business email compromise (BEC). In-mailbox email security flags it, because the request does not match how that director normally writes.

How is phishing different from spam? Spam is unwanted advertising. It is annoying, but it does not pretend to be someone else. Phishing pretends to be someone the person trusts, in order to steal. Even when a password is stolen, multi-factor authentication can stop the attacker from logging in, unless the person is also tricked into sharing the OTP. In India, a person who has lost money this way can report it on the national cybercrime helpline, 1930.