There are indeed several types of phishing such as phishing by email, by phone call, by SMS, by QR Code or even the one in your calendar… The social engineering developed by hackers is likely to see new types of phishing appear in the future.
In the meantime, you will find in our article a list of 11 types of phishing ranging from the best known to the least frequent and emerging ones.
1. Email phishing
Email phishing, which is the most widely used type of phishing, is at the origin of all the variations of phishing that exist today. Everything therefore happens by email, with the classic scheme.
An email imitating a reliable or institutional source invites you to click on a link or pay an amount by entering your bank details. The goal may be to retrieve your personal data, to retrieve your bank details or to make you carry out a transaction on an account while making you believe that you are acting on behalf of a trusted third party.
The forgery of an email from a source reputed for distributing a phishing email is also called clone-phishing.
2. Smishing, or SMS phishing
A contraction of the words “SMS” and “phishing”, smishing is a widespread technique that consists of sending a message to a mobile phone by SMS, containing a fraudulent link and/or a phone number to call back, generally urgently.
3. Vishing, or voice phishing
A contraction of the words “voice” and “phishing”, vishing is the phone-call variant of phishing.
To carry out vishing, cybercriminals use fraudulent phone numbers; they may also use software to alter their voice, text messages or even social engineering techniques to induce users to disclose sensitive information. The goal remains the same: getting you to reveal personal information or your bank details.
Example: You receive a call from an employee at Microsoft or from your antivirus telling you that you are currently the victim of a virus. To solve this problem, you absolutely must update your system, and/or reinstall your antivirus.
Which is doable right now with your fake agent on the phone, in return for an online payment, for which he will need your bank details.
An opportunity for the hacker to take your bank details, and to install malicious software (Malware) on your PC to then steal more data from you.
4. Whaling, or “big fish” phishing
A contraction of the words “whale” and “phishing”, whaling is a type of phishing that mostly targets companies, and more specifically, the people at the highest level of the organization chart, namely CEOs, chief financial officers or other directors with great responsibilities, and ideally, access to the company’s accounts.
Example: an email received states that the recipient’s company is being sued.
The recipient must then click on the link contained in this email in order to obtain more information. Clicking on the link then redirects the recipient to a fake official website, where the tax identification number, bank account number, etc. must be filled in, with the aim of regularizing the company’s situation and paying a fine to cancel the false proceedings.
5. Spear phishing
Spear phishing is a method for carrying out a phishing attack. This time no mass email is sent; the attack is highly targeted. This attack is methodical and can even be organized by a group of hackers. It is more generally an attack on a senior official, or on people holding state secrets or industrial secrets.
Based on espionage, the hacker(s) will therefore break into a person’s computer system to learn their connection practices, their searches, their connection times, their online habits, their schedule, etc.
Understanding the target will allow the hacker or their group to define the most effective angle for phishing the victim, and to make them reveal the confidential information they hold depending on multiple variables. Hackers even go as far as infiltrating social networks to observe their target’s areas of interest, personal concerns, points of vigilance, etc.
6. Spamdexing, or search engine phishing
A contraction of the word “spam” and the word “index” for indexing on search engines, this fraudulent practice consists of leading you to a fraudulent site when you search the internet, by indexing its fraudulent link as the first search result.
Once lured to a fake website, all interactions with the links or pages that are part of it can be exploited by hackers. They can also pose as the site’s chatbot so that you communicate ever more information about yourself, to collect sensitive data or bank details for example.
These hacker sites can pose as any website, but the trend is reportedly toward imitations of bank sites, imitations of money transfer sites, with booby-trapped links that are supposed to lead you to social networks, or even fake online shopping sites.
7. Phishing on social networks
The goal is to catch victims from social networks such as Facebook, Instagram, Twitter or LinkedIn, either to make you click in the wrong place and steal your personal data, or to take control of your own social network account, and thus impersonate you.
8. Quishing, or QR Code phishing
This latest arrival, which was more strongly spotted at the end of 2023, is a boon for hackers since the QR code, also called flashcode, has become very widespread following the Covid-19 pandemic. It can be found on our restaurant tables, in museums, on advertising posters, brochures and commercial leaflets, at trade shows and even on the back of some business cards…
For hackers, this new QR code format presents an additional opportunity: slipping more easily through the net of anti-spam or anti-phishing filters.
What really differs from other types of phishing is the format, since the scam begins not on the net or in a digital format, but on paper. The bait is therefore print.
There are two types of Quishing that we hear about a little more than the others:
a. The fake QR code linked to paying a parking fine
You were surprised to receive a parking ticket under your windshield wiper, with a small piece of paper that looks just like an official reproduction. On this paper, you find a QR code to pay your fine online. To settle your fake ticket, you then go to an unofficial site that looks in every respect like the amendes-gouv.fr site. Trusting, your payment journey will lead you to pay your fine, except that it will be made to a phisher’s account.
b. The fake QR code linked to payment at an electric vehicle charging station
Once again, this QR code scam is very hard to detect. If you have an electric vehicle, it is very likely that you have had to charge your vehicle somewhere other than at home.
In the parking spaces where electric charging stations are located, you are therefore used to paying at the station from your smartphone. Using a QR code affixed to the charging station itself, you pay from your mobile for charging your vehicle on a site provided for that purpose, and your vehicle’s charging is supposed to take place within an adequate period of time.
And what if the sticker bearing the QR code was covered by its malicious twin? And what if this QR code as well as the site you were redirected to from your mobile were also exact copies of those you are used to using to charge your vehicle?
You will therefore calmly pay for your electric charge, and the transaction will not be made to the account of your electric charging station’s provider but to that of a hacker. Also, you will naturally not have activated the charging station (which is activated following a payment), and your electric vehicle will not be charged.
9. The fake appointment phishing in your calendar
This type of phishing does not yet have a name but we could call it meetphishing (or even meetshing?).
It consists of sending you an invitation directly in your calendar. As the latter contains a fraudulent link, you must absolutely make sure that this source is known to you before accepting it by checking the link (whether it contains a random string of digits and letters, the name of an unknown sender, a strange beginning or terminology, etc.).
These invitations can affect all types of devices, from Google Meet to your smartphone.
If you ever have any doubt, do not click on this link, do not accept the appointment, and immediately block the sender.
10. BEC – Business Email Compromise
BEC attacks are a type of email phishing in which a company executive or other representative is impersonated. They may invoke an urgent situation and ask you to act immediately (click on a link, send information). It is very different from other types of phishing since, in addition to being targeted, it does not carry a malware, a link or a corrupted attachment.
This request probably goes against the company’s security policy and common sense, but the false sense of urgency aims to make you panic and act before thinking.
11. EAC – Email Account Compromise
EAC is an attack that aims to compromise a user’s email account, then to access their inbox through various social engineering techniques. Once the email account is compromised, the attacker will then use it to send phishing emails to the user’s contacts in order to steal data, funds and personal and sensitive information.
Did this article on the different types of phishing interest you, and do you want to know tips for foiling them?
Also read our articles:
