page_title: Phishing
section_title: User training
hierarchical_section_title: Phishing / Anti-phishing / User training
caption_attribution_description: English: Frame of an animation by the Federal Trade Commission intended to educate citizens about phishing tactics.
context_page_description: Phishing is the fraudulent attempt to obtain sensitive information or data, such as usernames, passwords and credit card details, by disguising oneself as a trustworthy entity in an electronic communication. Typically carried out by email spoofing, instant messaging, and text messaging, phishing often directs users to enter personal information at a fake website which matches the look and feel of the legitimate site.
  Phishing is an example of social engineering techniques used to deceive users. Users are lured by communications purporting to be from trusted parties such as social web sites, auction sites, banks, colleagues/executives, online payment processors or IT administrators.
  Attempts to deal with phishing incidents include legislation, user training, public awareness, and technical security measures.
  The word is a neologism created as a homophone of fishing.
context_section_description: People can be trained to recognize phishing attempts, and to deal with them through a variety of approaches. Such education can be effective, especially where training emphasises conceptual knowledge and provides direct feedback.
  Many organisations run regular simulated phishing campaigns targeting their staff to measure the effectiveness of their training.
  People can take steps to avoid phishing attempts by slightly modifying their browsing habits. When contacted about an account needing to be "verified" (or any other topic used by phishers), it is a sensible precaution to contact the company from which the email apparently originates to check that the email is legitimate. Alternatively, the address that the individual knows is the company's genuine website can be typed into the address bar of the browser, rather than trusting any hyperlinks in the suspected phishing message.
  Nearly all legitimate e-mail messages from companies to their customers contain an item of information that is not readily available to phishers. Some companies, for example PayPal, always address their customers by their username in emails, so if an email addresses the recipient in a generic fashion ("Dear PayPal customer") it is likely to be an attempt at phishing. Furthermore, PayPal offers various methods to determine spoof emails and advises users to forward suspicious emails to their spoof@PayPal.com domain to investigate and warn other customers. However it is unsafe to assume that the presence of personal information alone guarantees that a message is legitimate, and some studies have shown that the presence of personal information does not significantly affect the success rate of phishing attacks; which suggests that most people do not pay attention to such details.
  Emails from banks and credit card companies often include partial account numbers. However, recent research has shown that the public do not typically distinguish between the first few digits and the last few digits of an account number—a significant problem since the first few digits are often the same for all clients of a financial institution.
  The Anti-Phishing Working Group produces regular report on trends in phishing attacks.
  Google posted a video demonstrating how to identify and protect yourself from Phishing scams.
caption: Frame of an animation by the U.S. Federal Trade Commission intended to educate citizens about phishing tactics.
exif: {}