Cybercriminals most often impersonate:
- Banks and financial institutions: informing about alleged problems with the account, the need to verify data, or unauthorized transactions.
- Courier companies/Post Office: sending notifications about the necessity to pay extra for a shipment, a change in delivery status, or package collection.
- Service providers (telecommunications, energy, internet): threatening to block the service or informing about overdue payments.
- Social media platforms and shopping websites: in order to extort login data.
- Friends or colleagues: using trust to extort money or information.
The goal of the attack is always the same: to trick the victim into performing a specific, dangerous task. This may be:
- Clicking a link: This redirects the user to a fake website (so-called fake payment gateway or login page) that is visually identical to the real one. There, the victim unknowingly enters their data, which falls directly into the hands of criminals.
- Downloading an attachment: This usually contains malicious software (malware), such as viruses, trojans, or spyware, which infects the device and allows scammers to steal data.
- Directly providing data: By replying to the message or filling out a form embedded in the fake message.
Phishing is dangerous because it exploits the human factor (social engineering). Criminals play on emotions such as fear (of losing money), curiosity (about an attractive offer), or the desire to quickly resolve an issue, which causes victims to act rashly, ignoring basic security rules.