Phishing

Phishing messages usually arrive by email or text message and contain links to malicious websites. Those sites may host malware such as ransomware, or be fake websites built to collect passwords and other personal information. Variants are named for their channel: smishing uses SMS text messages, vishing uses voice calls, and quishing uses a QR code that leads to a malicious website.

Some phishing goes out indiscriminately to millions of inboxes. Spear phishing targets a specific person or small group and uses personal details to make the message more convincing, and whaling targets senior leaders to push through fraudulent payments. Staff who handle sensitive information, manage financial assets, or administer IT systems are of greater interest to attackers.

No training can teach users to spot every phishing message, so the NCSC recommends four layers of defense: make it hard for attackers to reach users, help users identify and report suspected phishing, protect the organization from phishing emails that get through, and respond quickly to incidents. Measures include email filtering, DMARC to stop attackers spoofing the organization's domain, and multifactor authentication, so that a stolen password alone does not open an account.

For individuals, the FTC notes that legitimate companies will not email or text a link to update payment information. When an unexpected message asks for a click, it advises contacting the company through a phone number or website already known to be real, and reporting and deleting the message if it shows signs of a scam.