Nine different types of phishing

Phishing has been a tactic utilised by cybercriminals for decades now but unfortunately, methods and techniques are forever evolving which means you may not be as safe as you might think from an attack. Before learning how to prevent a phishing attack, it’s worth learning more about these different types of phishing so you can familiarise yourself with what you might expect to find if someone does try and hack your accounts and devices.

Different types of phishing – Nine examples

Email phishing

One of the most common methods of phishing is email phishing. This is where the attacker will impersonate a large organisation to send victims an email claiming their account on said organisation has been compromised. They will then include a link for the user to ‘reset their details’ but the link in question will be a fake domain that when opened will compromise your device and allow the hacker access to your files.

Spear phishing

Spear phishing is a brutal type of phishing as if you are spear-phished then the person behind the attack likely knows you. This type of Phishing is where malicious emails are sent but in a much-more personalised way than a standard phishing email. The message will address you personally and will usually be asking for something that makes sense in relation to whatever is actually going in your life such as payment for a legitimately booked table somewhere.

Angler phishing

Angler phishing is a relatively new tactic employed by criminals and one that is entirely reliant on social media. An attacker will set up a fake social media account that mimics a business and then targets users who have made recent, public complaints about that business on social media. On the fake account, they will then message these people and ask them for personal information, pretending that they are a customer service operator looking to organise compensation.

Smishing

Smishing is effectively just a standard phishing attack except instead of taking place over email it takes place over text. The attacker will send a blanket message to thousands of random mobile phone numbers claiming that their accounts have been breached, either on a social media platform for example or their online banking. The text message will then contain a link that if clicked will spread malware around the victim’s phone and allow the attacker access to their device’s files.

Vishing

Vishing also takes place via mobile phones, however, instead of text messages the attack takes place via phone call or voicemail. The person on the other end of the line will claim to be from a reputable business (usually a bank or mobile phone company) and then try and scare you into providing them with key personal information such as credit card numbers.

Whaling

Whaling attacks are targeted phishing attacks at senior executives. In many ways, they play on the egos of senior CEOs to try and get financial gain from them or their business. Typically, these attacks will be sent ‘from’ other senior executives at the company which often makes the receiver scared to refuse the request, just in case they’d be saying no to someone at the top of their company.

SEO phishing

SEO phishing is where attackers go to the effort of buying a highly-ranking website on Google and converting it into a malware-ridden trap for unsuspecting web browsers. These will typically be websites that bear resemblance to legitimate websites but with a typo in their name. They effectively bank on users making a typo on their Google search and things spiralling from there.

Clone phishing

Clone phishing is where perpetrators don’t even have to go through the hassle of creating an email themselves. Instead, they simply copy and paste an identical support email they’ve received in the past from a reputable company and then send it on to thousands of email addresses with a malicious link added in for good measure.

Pop-up phishing

You may think that you are too smart to fall for pop-ups in 2024 but you’ll be surprised by how many pop-ups you blindly click on each day. Think about cookie requests each time you visit a website, it’s not second nature to simply click ‘allow all’, right? Well, top cybercriminals are now building pop-ups that resemble these cookie requests and planting them on websites.