# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 3 Phishing Methods and Techniques
### Phishing Technical Approaches
#### 3.3.1. Spear Phishing  
Spear phishing [34] is a targeted approach to phishing in contrast with the generic mass production of spam mail. More accurately, it is a targeted attack against an individual or organization that utilizes specially crafted materials (usually emails that appear to have come from people the victims already know), to improve the chances that the individual who opens the email will be tricked into doing whatever it is the sender desires. To this end the email content must also appear to be innocuous, that is, it must also relate to something the target finds relevant, so that the email and instructions do not raise the suspicion level of the intended victim. The email may refer to the target by name and include information that the target would not suspect others to have access to, in addition to the service the phisher is impersonating. For this purpose, LinkedIn (or other forms of social media) is a common platform for a phisher to conduct research for this type of attack because it is relatively easy to find a target's profession and other personal details. Focusing on specific targets requires additional time and effort in the planning phase by the phisher, but with the advantage of a higher chance of pay off [19]. As described previously, spear phishing remains the largest infection vector [5] for an attack. The attack itself is dependent on the goal of the phisher and may vary from a \"click the link\" scenario to downloading a malware-laced attachment. The success of a spear phishing attack relies on fundamental aspects of human psychology. These are:  
* Authority--humans tend to comply with demands of authority figures demand. * Commitment--the principle that once a human has taken a position on a topic, they feel pressured to defend that stance. * Liking--the principle that people are more likely to do things for people they like (this may be only superficial; for instance, complying with people of their own age or sharing their interests). * Contrast--this makes an initially unreasonable option seem more appealing because it is preferable to a choice presented in tandem with the first option. * Reciprocity--humans like to return or reciprocate in kind objects presented to them by another. * Scarcity--perceived value is used to entice a person to perform a desired action when the availability of this offer is limited. * Social proof--that is, herd mentality. A person is more likely to follow the majority rather than risk making a mistake. Use of these principles increases the chance of success of a phishing attack [36; 37]. For example, a common technique seen in phishing emails is the use of the scarcity principle. This involves tricking the victim into clicking a malicious link by disguising it as a \"once-in-a-lifetime\" offer that is only available for a limited time. Because the time to take advantage of this opportunity is limited, the probability of the victim clicking the link immediately, without thinking, is increased. Another commonly seen example is the use of authority. In this scenario, the victim is informed that something has happened (i.e., a successful login attempt from another country), and the victim must first login before this issue can be rectified. In this scenario, the phisher makes a demand from a place of authority with which the victim is expected to comply without question. These principles can also be used in other forms of phishing or manipulation, but in spear phishing attempts, these factors can be applied more accurately. Several studies have identified that older women are by far the most susceptible to phishing attacks [36; 37]. Among the principles outlined above, the most effective methods involve the use of scarcity or authority in all age groups. However, older users show more susceptibility to reciprocation, whereas younger users are more vulnerable to the use of scarcity.