Why does one convincing email fool even careful people?
Researchers scattered 297 USB drives around a university campus, and 98 percent were picked up.
▶ Start the storyOne convincing email can fool careful people because phishing does not attack the computer: it attacks the person reading it. Phishing is a form of social engineering, where attackers deceive people into revealing sensitive information or installing malware. Social engineering in general is the use of psychological pressure to get people to act or hand over confidential information.
The tricks lean on how people decide things in a hurry. A message pretends to come from a trusted source, such as a bank, and creates urgency, for instance by threatening to close your account. The link leads to a counterfeit page that collects your login. Even the address can lie: in http://www.yourbank.example.com/ the real site is example.com, and "yourbank" is only a label the attacker chose.
Step 1: Pose as someone trusted
A bank or a colleague
Step 2: Create urgency
Your account will be closed
Step 3: Send you to a fake page
Looks like the real one
Step 4: Collect your login
Or install malware
Careful people fall for it because attacks can be tailored. General phishing is sent to everyone, but spear phishing targets one person or group, using personal or organizational details to look credible. Russian group Fancy Bear used spear phishing against people linked to Hillary Clinton's 2016 campaign and the Democratic National Committee.
Nor is it only email. In a study published in 2016, researchers dropped 297 USB drives around a university campus. Of those, 290 were picked up, and 135 "called home" when someone opened the files. Curiosity did the rest.
Quiz me
0/3
Recap
Phishing works by pretending to be trusted and by creating urgency, and the address in a link can lie about where it really goes.
💡 A trick to remember it · Phishers bait a hook with trust and a ticking clock: the hurry is part of the bait.
Surprising fact · 98% of dropped USB drives were picked up in a university study.
Sources (2)
No source, no claim. Every fact in this lesson (15 claims) cites at least one of these.