Hooked by a Fake: Understanding Phishing Attacks

Imagine you open your email and see this: 'URGENT — Your account has been suspended. Click here NOW to restore access or lose everything.' Your heart speeds up. You hover over the link. Should you click? This feeling — urgency mixed with panic — is exactly what cybercriminals want you to feel. Before you learn how to spot their tricks, think about this: why might someone deliberately try to make you act quickly without thinking?

Phishing (say: 'fishing') is a type of cybercrime where an attacker sends a fake message — usually an email, text, or social-media message — designed to trick you into giving away personal information. That information might be a password, a bank account number, or your home address. The name comes from the idea of a criminal 'fishing' for victims by dangling bait and waiting for someone to bite. **How a phishing attack works — step by step:** 1. **Bait:** The attacker creates a message that looks like it comes from a trusted source: a bank, a streaming service, a school, or even a friend. They often copy real logos and formatting to make it convincing. 2. **Hook:** The message contains a link to a fake website (a spoofed site) that looks almost identical to the real one. When you type in your login details, the attacker captures them. 3. **Catch:** With your credentials, the attacker can access your real account, steal money, sell your data, or take over your identity. **Common types of phishing:** - **Email phishing** — mass fake emails sent to thousands of people at once. - **Spear phishing** — a targeted attack aimed at one specific person, using personal details to seem more believable. - **Smishing** — phishing via SMS text message. - **Vishing** — phishing by voice call, where someone pretends to be from a bank or government agency. **Warning signs to look for:** - The sender's email address looks almost right but has a subtle mistake (e.g. support@paypa1.com instead of support@paypal.com). - The message creates urgency or fear ('Act now or your account will be deleted'). - It asks you to click a link and enter a password or payment details. - Hovering over the link reveals a URL that does not match the supposed sender. - There are spelling mistakes or awkward grammar. - It promises an unexpected reward ('You have won a prize!'). **What to do if you suspect phishing:** - Do NOT click any links or open attachments. - Do NOT reply to the message. - Report it: use the 'report phishing' or 'report spam' button in your email or messaging app. - If it pretends to be from a real company, go directly to that company's official website by typing the address yourself. - Tell a trusted adult and, if needed, report it to your national cybercrime authority.