How To Avoid Getting Hooked By Mobile Phishing

The first recorded use of the term ‘phishing’ was in 1996, in the earliest days of the Web. So why is this 20+ year-old method of online fraud still with us?

- Brian Gleeson

For one very simple reason: it works very effectively. It’s one of the most reliable methods a hacker can use to steal access to personal or business digital accounts. The FBI has estimated that the total losses from business email compromise alone – a highly targeted variant of phishing – have exceeded US$12 billion globally.

Phishing has become an industrialized process. It’s estimated that around one in every 2,000 emails is a phishing email, and over a million fake websites are created every month to try and trick users into giving away personal information. A recent study showed that 25% of phishing emails bypass Microsoft Office 365 security. For criminals, it’s a numbers game: they just need to distribute enough emails and links to fake sites, and wait for people to fall into their traps. And as more and more transactions are conducted via mobile devices, mobile users are being increasingly targeted – with increasing success.

There are several reasons for the rise in mobile phishing attacks. First, the ergonomics and smaller screen size of mobiles makes it harder for users to inspect an emailed URL that they are asked to click on – and easier for scammers to attract unwitting visitors to their fake sites. Second, mobile devices are typically used to connect to multiple email accounts, enabling hackers to target both business and personal accounts. And finally, smartphones can also be targeted by phishing texts, and by malicious apps too, giving the attacker a range of methods to try and get victims hooked. Let’s take a closer look at each of these three main phishing vectors.

SPEAR PHISHING BY EMAIL