# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 1 Introduction  
Phishing is a social engineering technique that, through the use of various methodologies, aims to influence the target of the attack to reveal personal information, such as an email address, username, password, or financial information. This information is then used by the attacker to the detriment of the victim [1]. The term phishing is derived from the word \"fishing\", spelt using what is commonly known as Haxor or L33T Speak. The logic of this terminology is that an attacker uses \"bait\" to lure the victim and then \"fishes\" for the personal information they want to steal. The first instance of this technique was reported in 1995 when attackers used phishing to convince victims to share their AOL account details [2, 3]. The word \"phishing\" was first printed in media in 1997 [4]. Subsequently, phishing has grown and developed. Attackers have devised new methods and utilized new media, and it is now one of the primary attack vectors used by hackers. As of 2018, Symantec found that email-based phishing rates had fallen to 1 in 3207 emails, from 1 in 2995 emails in 2017 and 1 in 392 in 2013 [5, 6]. The proportional incidence of this generic type of phishing attack consistently fell during the past four years; however, this may in part be due to a greater number of emails being sent rather than a reduction in phishing attempts. Despite this apparent decrease in phishing attacks, the APWG (the Anti-Phishing Working Group) reported that phishing rates rose to their highest levels since 2016 in the third quarter of 2019 [7, 8]; the trends in unique phishing websites between 2013 and 2019 can be seen in Figure 1. Furthermore, phishing attacks continue to be widely utilized; for example, spear phishing is the most common infection vector for the distribution of malware, used by 71% of groups in 2018 and 65% of groups in 2019 [9], as can be seen in Figure 2. Furthermore, the number of phishing Uniform Resource Locators (URLs) increased by 20% between 2017 and 2018 [6], with two-thirds of these phishing sites now utilizing a Secure Sockets Layer (SSL). This was the highest rate since 2015, leading to the new and concerning conclusion that https is no longer a suitable indication of a site's safety [7]. In recent years, the main focus of phishers has been SaaS (Software as a Service) and webmail, which accounted for 33% of the attacks against a range of industry sectors [8]. IBM identified that 27% of phishing attacks in 2018 were focused on webmail services. It was also noted that 29 percent of the attacks against businesses that were analyzed by X-Force identified the source of the breach as a phishing email [10]. Regarding the financial aspects of phishing, Symantec found that in the underground economy \"custom phishing page services\" are being sold for between USD 3 and 12 [6], indicating that the overhead for setting up a custom phishing attack is minimal. It has also been found that gift cards are now among the most common ways for a scanner to cash out their earnings [7]. The FBI estimated the 2018 victim loss due to phishing was USD 48,241,748, with 26,379 people affected by this type of scam [11]. In 2018, the FBI received around 100 complaints, with the most commonly targeted industries being healthcare, education, and air travel, which resulted in a combined net loss of approximately USD 100 million dollars. This scam involved the use of phishing emails to target employees and discover their login credentials. These were then used to gain access to the payroll system, after which rules were implemented by the phishers so that employees no longer received notifications about changes made to their accounts. The phisher was then able to change account holders' direct debit information to funnel the funds into their own account, which in this instance involved a prepaid card [10]. From industries such as healthcare and education to individuals playing games online, the impacts of phishing attacks are widely felt.