Attacking the person, not the device
A well-secured device or account can still be undone by a convincing message. Phishing is the practice of sending messages that pretend to come from a trusted source, such as a bank, a delivery firm, a code hosting site or a colleague, in order to get you to reveal a login, open a harmful file or approve something you should not. Social engineering is the wider term for manipulating people into helping an attacker, whether by email, text, phone call or in person.
These attacks are common because they often work better than technical ones. It can be easier to ask someone for their password than to find a flaw in the system that protects it.
Common forms
Email phishing. A message claims your account is locked, a payment failed or a document is waiting. A link leads to a page that looks like the real site and collects whatever you type.
Targeted phishing. Sometimes called spear phishing, this uses details about you, such as your name, employer, projects or recent purchases, to look more believable. A maker who posts publicly about their hardware or accounts may be easier to target than they realise.
Text messages and chat. Short messages with a link, a delivery notice or a “wrong number” opening are used for the same goals. Messaging apps and social platforms add accounts that impersonate friends.
Phone calls. A caller claims to be from technical support, your bank or your internet provider and presses you to act. This is sometimes called voice phishing.
Fake support and fake software. A search result or advert leads to a counterfeit download page for a tool you need, or a pop-up tells you your computer is infected. Makers who regularly download drivers, firmware and libraries should be wary of unofficial sources.
Pretexting and in-person tricks. The attacker invents a believable story, perhaps as an engineer, delivery driver or new employee, to gain access, information or a favour. Leaving a USB stick for someone to find is an old tactic of the same kind.
Approval fatigue. If an account has app prompts for login, an attacker who already has your password may trigger repeated prompts hoping you tap “approve” to make them stop. This is one reason that different forms of two-factor authentication resist attack differently.
The levers they pull
Most of these tricks rely on a handful of emotional pushes:
- Urgency: “Act within an hour or your account is closed.”
- Fear: a claim of fraud, a legal problem or a security breach.
- Authority: a message that looks like it is from a boss, a bank or an official body.
- Reward: a prize, refund or job offer.
- Helpfulness: a request that plays on your wish to be useful.
When a message tries to rush you or provoke a strong feeling, treat that as a signal to slow down. Attackers want you to act before you think.
Signs worth checking
No single sign is proof, and good fakes look convincing, but these are worth a look:
- The sender’s address does not match the organisation, or differs by a character or two.
- A link’s visible text says one thing but the real address, shown when you hover or press and hold, is different.
- Greetings are generic, or the message contains odd wording, though modern fakes may be polished.
- An unexpected attachment, especially an archive or document asking you to enable content.
- A request for a password, a one-time code or payment in an unusual form.
- A page address that is slightly off, for example a different ending or a misspelled name.
Be aware that a padlock symbol in a browser only means the connection to that site is encrypted. It does not show that the site is honest.
Habits that blunt these attacks
Go to the source yourself. If a message says there is a problem with an account, do not use its link. Open the site by typing the address you know, or use a saved bookmark or the official app, and check there.
Use a password manager. Password managers usually fill in logins only on the address they saved, so a lookalike page gets nothing. If it does not offer your login, ask why.
Never share one-time codes. A genuine organisation will not ask you to read out a code sent to you. Anyone who does is almost certainly trying to get into your account.
Prefer stronger two-factor methods. Hardware keys and similar methods check the website address as part of the login, which makes it difficult to hand your credentials to a fake page. Codes typed by hand and app approvals are still helpful but can be tricked.
Verify by another route. For a call or a request from a boss or relative, hang up and call back on a number you already hold. Check financial or access requests with the person directly.
Keep your public details modest. The less an attacker can learn from your public profiles, the harder it is to build a convincing story.
Download from official places. Get firmware, drivers and libraries from the vendor or the project’s real repository, and compare checksums when they are provided.
Report and delete. Most email and messaging services let you mark messages as phishing. If a message looks like it targets an organisation you belong to, tell the people who run its security.
If you think you were caught
Do not panic or hide it, since speed matters and attackers count on embarrassment. Change the affected password from a device you trust, using a unique new one. Sign out other sessions if the service allows it, turn on two-factor authentication and check for unfamiliar settings, forwarding rules or recovery details. If the account was reused elsewhere, change those logins too. If money or a work account is involved, contact the relevant provider or organisation promptly.
Everyone can be fooled once, including experts. The aim is not perfect vigilance, but a few reliable habits and the willingness to pause.