Hameçonnage, phishing, filoutage: these three words mean the same thing, a very widespread scam on the web. Before going into detail, let us review the semantics.

The term hameçonnage was defined in 2004 by the Office québécois de la langue française. Yes, the chosen word and the definition were born in the French-speaking world, even before being born in France.

The term filoutage was defined two years later in France, in 2006, by the Commission générale de terminologie et de néologie.

As for the term Phishing, there are several theories on the origin of the English-language term.

1. Phishing would be the contraction of the English words “fishing” for the activity of angling, and “phreaking”, another malicious practice that defines the hacking of a telephone line,
2. Phishing would be the name given by hackers to this practice, because they had the expression “Password Harvesting Fishing”, i.e. the translation “fishing for passwords”. The first letters of the words “Password” and “Harvesting” were therefore kept to be assembled and contracted with the last word “fishing”, which would have given birth to the term “Phishing”.

Now that you are comfortable with one of these three terms, let us get down to business.

Phishing, a very widespread malicious practice on the internet

Phishing is one of the oldest and best-known malicious practices on the net in the world of cyber scams.

This technique, used by hackers, also described as fraudsters, consists of collecting your personal data in order to steal your identity, and in most cases, to steal your money.

1. When did phishing appear?

The first case of phishing dates back to the mid-90s, with an attack aimed at stealing usernames and passwords on AOL (a messaging service), devised using tools such as “AOHell”.

The principle seems simple, but still works today with a similar logic: A hacker posed as a member of the AOL team by sending an e-mail to another address, that of a potential victim. This message asked the victim to give their password to “verify their AOL account” or “confirm their banking information”. Once the victim had revealed their password, the attacker could access the account and use it for malicious purposes.

2. What type of fraudulent e-mail or link can be phishing?

If you had to remember one thing, it is that for these hackers, every means is good to lower your level of vigilance and make you click where they want you to click.

For most of these attacks, phishing consists of a reproduction of an e-mail coming from a source “known” to you, which you could quite readily consider “reliable” since you consult it more or less regularly. This is what is called a trusted third party. It is also very common for the sender to pose as an official body (Tax office, Family allowance fund…).

Your mail may therefore contain an invitation to click on a link to:

• give you an exceptional offer on your usual shopping site,
• give you VIP access to information related to your interests,
• ask you to settle an invoice that you supposedly forgot to pay or settle,
• subscribe you to a page too trendy and too unmissable not to click on,
• invite you to open a file attached (at random, in PDF format) with all the info you have recently been looking for in your search engine…

With a little illusionist’s trick, your supposedly “official” e-mail and the “100% secure” link you clicked on with confidence turned out to be a fake e-mail, coming from a malicious source.

So why did nothing jump out at you?

Quite simply because the reproduction of an e-mail from the trusted third party in question was made well enough for you to believe it. This deception is called social engineering, or psychological hacking.

Clicking on the link set the process in motion and you will then be phished.

Phishing in France: the most widespread practices

We have compiled a non-exhaustive list of the most widespread phishing attacks in France (in 2021).

1. Fake messages about child pornography offenses.

This scam was the most widespread in 2021. The scam consists of a message posing as a national public authority (police or gendarmerie) or European authority (Europol or Interpol) accusing the victim of pedophilia or child pornography. For these alleged acts, the victim is then asked to pay a large fine of several thousand euros to avoid legal proceedings.

2. Fake tax or social security refund messages

Calls, e-mails, SMS, social networks, Ameli.fr is not spared by cybercriminals, who try by all means to deceive internet users by posing as the French health system. On its site, Ameli.fr gives a few examples to avoid falling into the trap.

3. Parcel delivery scam messages

In this case, the victim receives a message by e-mail or SMS, which seems to come from well-known transport companies. Messages received by SMS generally display:

• a sender name
• the name of a well-known delivery service,
• a short 5-digit phone number (starting with 38) that looks like those used by real delivery services.

This message states that a parcel is to be delivered to you and that you must pay postage or shipping fees, VAT or customs for it to reach you.

A small amount is requested, which encourages the victim to make the payment by clicking on the shared link.

This link will redirect to a fraudulent website impersonating the delivery company. During the fake payment process, the victim will be asked for personal information such as their identity, postal and/or e-mail address, a phone number, bank card details, all to pay the supposed delivery or customs fees claimed.

4. Phishing messages targeting bank accounts and cards

The security of payment methods is at the heart of cybercriminals’ process; they used a fake payment security system to lower their victims’ vigilance a little more when making an online transaction.

5. The personal training account (CPF) scam is still current as of mid-March 2022.

By SMS, by e-mail and even through phone calls, the scam, which aims to put you at ease so that you reveal personal information, generally aims to hack your CPF account, or even to force your hand into using your balance. The expiry of your CPF balance is often the argument that makes the victim act quickly.

6. Fake technical support scams, or “Tech Support Scam”

The principle is to scare the victim by sending them a message (by SMS, phone, chat, e-mail, or by the appearance of a message on the victim’s screen that locks their computer) telling them of:

• a serious technical problem,
• a risk of losing their data
• the loss of use of their equipment

This must lead the victim to contact the supposed official technical support to fix it. You will have understood that the pseudo IT troubleshooting and/or the purchase of sometimes harmful software recommended by the fake technician are paid for. As an additional pressure element, if the victim refuses to pay, the cybercriminals keep some last cards to make the victim give in, ranging from the destruction or loss of files to the disclosure of their personal information.

7. Phishing by SMS, or smishing and this concerns all types of for-profit organizations, but also associations, or administration. It is the same principle as e-mail phishing, but the delivery channel is different since you will receive this type of phishing by SMS and not by e-mail.

What do hackers do with your data?

Unfortunately, there is only one possible answer to this question: hackers will do whatever they want with your data.

From the moment you open this link, your PC will be infected, and your data will be accessible via the malicious software in your electronic device or from your mailbox, and may be exploited by the hacker(s).

1. What types of data are sought and stolen by hackers?

a- Personal data:

If a hacker or a collective of hackers can get their hands (and eyes) on your e-mails, then how far back in time can they sift through your personal life? Be aware that by opening your mailbox, they can even access your drafts, your archived e-mails and your spam.

You do not have to look far to imagine that a hacker could access very sensitive information, and engage in blackmail, in order to:

• force you to reveal more information about your employer or your administration,
• push you to pay sums of money so as not to reveal certain elements of your past life,
• reveal your search history to your employer or to your loved ones,
• to retrieve personal photos of you and/or your entourage,
• to access ever more personal accounts (social networks, Apple or Android IDs…)
• to resell your data on the Dark Web, to other hackers for example…

You can let your imagination run without limits, or draw inspiration from the worst disaster scenarios of your last action film, or your latest Netflix series. If not everything is real, almost everything is feasible.

b- Professional data

You are an individual, and are probably also an employee, or work on behalf of a non-profit organization, or for the administration.

Hackers can indeed target a company’s personnel through their professional mailbox, for example.

This type of attack can be motivated by many reasons.

A hacker could, for example, disclose sensitive information about your company through your e-mail exchanges, or even make payments if he accesses your company’s bank details.

The hacker(s) could just as well try to access companies’ networks to spy on them and infect them with malicious programs.

Phishing could therefore be just one stone in the edifice leading to a harder hack, and other types of attacks and intrusions such as spear phishing, ransomware, wipers, to name only a few…

c- Banking data

Your bank card and therefore your checking account no longer belong to you. Well, it no longer really belongs to you if you consider that a bank account must not be shared with an unknown person. With phishing, victims are often led to give their bank details to hackers, thinking they are paying a bill to the administration, or to a usual supplier such as an internet service provider for example. It can even come from a shopping site, if you enter your bank details thinking you are finalizing an order placed on Amazon, Ebay, Fnac, Vinted, Wish, Alibaba, Shein etc.

d- Confidential and national defense secret data

States themselves are equipped with hackers, called Ethical Hackers. More precisely, administrations are equipped with cyber defense and cybersecurity departments. The French army also has a cyberdefense department, and a “virtual army” to fight cyberattacks, cybercrime, theft, espionage and all types of intrusions at state level.

We began writing this article in mid-March 2022, and are for the moment in France spectators of a cyberwar in the East of Europe, and the West of Asia. The conflict between Russia and Ukraine is also taking place on the internet. Keep your secrets in your heads. The more digital media there are that contain information, the more accessible it becomes.

The motivations are many, and consequently, the number of phishing attacks is too, and the types of phishing have multiplied as well!

At Numeryx, we have detected that a large part of intrusions could be prevented as soon as you were equipped with a next-generation firewall. That is why we developed our Asguard firewall.

Phishing around the world in figures and statistics

1. Nearly half a billion phishing e-mails were detected in the month of January 2023 alone with exactly 488.5 million phishing e-mails, according to Vade
Source : Vade – Phishing and malware report Q1 2023

2. A significant increase in phishing attacks of 47.2% was observed in 2022 compared with 2021, according to Zscaler
Source : Zscaler – 2023 Phishing Report

3. 89% of unwanted messages manage to get past e-mail authentication methods, according to Cloudflare
Source : Cloudflare – Phishing Threat Report 2023

4. In 2022, 54% of phishing e-mails contained .com links, while 8.9% of them had .net links, according to AAG-IT
Source: AAG-IT – The latest phishing statistics

5. Phishing e-mails have seen an increase of 1,265% since the end of 2022 and the launch of ChatGPT, according to SlashNext
Source : SlashNext – The State of Phishing 2023

6. 75% of organizations worldwide were affected by phishing in 2020, according to Tessian,
Source : Tessian – Phishing Attacks Statisctics 2020

7. 96% of phishing attacks are carried out by e-mail, according to Verizon
Source: Verizon (Data Breach Investigations Report 2021

8. Google discovered more than 2.1 million phishing sites in January 2021, a figure that is constantly increasing.
Source : Google Safe Browsing (January 2021),

9. 1 in 4,200 e-mails would be a phishing e-mail, according to Symantec
Source : Symantec (Threat Landscape Trends – Q1 2020)

10. PDF is the most corrupted type of document attached to phishing e-mails, according to Tessian
Source : Tessian – Phishing Attacks Statisctics 2020

11. The top 3 types of data most compromised in a phishing attack, according to Verizon

• Credentials (passwords, usernames, PIN codes…)
• Personal data (last names, first names, postal addresses, e-mail addresses…)
• Medical data (information on medical treatments followed, compensation claims…)

Most of this collected data allows cybercriminals to better understand how to move on to the stage related to extorting money.
Source : Verizon Data Breach Investigations Report 2021

12. The top 5 sectors of activity most affected per employee, according to Tessian

• Retail with about 49 fraudulent e-mails sent to each employee per year.
• Manufacturing with about 31 fraudulent e-mails sent to each employee per year.
• Food and beverage with about 22 fraudulent e-mails sent to each employee per year.
• Research & Development (R&D) with about 16 fraudulent e-mails sent to each employee per year.
• Tech with about 14 fraudulent e-mails sent to each employee per year.

Source : Tessian’s 2021 research

13. More than 80% of cybersecurity events involve phishing attacks
Source : Email Threat Report 2020, Teiss