Phishing

Phishing is a social engineering attack that uses fake messages — most often email — to persuade you to give away information or follow a link. It attacks the person rather than the technology: your device may be perfectly secure, but you can be talked into handing things over yourself. That is why people are called the weak point in a system.

How a phishing message works

A phishing message is disguised to look as though it comes from someone you trust — a parcel courier, a ticket website, your school's IT support team — copying real logos and wording.

It also pushes you to act before you have time to check:

• Urgency — your account will be closed by 5pm unless you respond.
• Fear — a warning that something has already gone wrong and only you can put it right.
• Curiosity or reward — a message saying you have won a prize and must claim it quickly.

For example, a message that looks like it comes from a games store says an order for £39.99 has just been placed on your account and will be charged within the hour unless you cancel it. You have never shopped there, so you click Cancel in a panic and land on a sign-in page. With no time to check, you type your details in — exactly the plan.

What happens when you follow the link

Following the link can lead to two outcomes, and both are a threat:

1. A fake login page that looks identical to the real one. Whatever you type into the boxes goes to the attacker, not the website, so your details are stolen.
2. A page that quietly plants malware. It may ask you for nothing at all: it simply loads harmful software onto your device while you look at it, giving the attacker a way in.

The aim is to obtain your data or access to your account by deceiving you, not by defeating the security software.

Phishing and malware are not the same thing: phishing is the con trick, malware is the harmful software the trick can leave behind. The two often arrive together.