Despite being around since the mid-90s, phishing remains one of the most persistent and successful cyber threats. With its goal of tricking people into sharing sensitive information or downloading harmful software, phishing allows cybercriminals to steal people’s money, access their accounts, or commit identity fraud.

Over time, phishing has evolved into numerous forms and has become vastly more sophisticated, challenging even experienced internet users. In this article, we reveal the five main types of phishing plaguing the internet today. Get acquainted with them and follow our advice on protecting yourself so you never become a victim.

1.      Classic Email Phishing

One of the oldest and most profitable cybersecurity risks is email phishing. It involves faulty messages crafted to look like they’re from a trusted source, such as a bank, ISP, or government agency. Cybercriminals replicate reputable sources’ appearance, writing style, and email headers to make the message look authentic and convincing.

Typically, phishing emails alert you to a problem or provide a tempting opportunity. They urge you to click a link or view an attachment in the message immediately.

Attachments usually contain malware that can harm a person’s device, from logging keystrokes to locking it down. Links direct you to a spoofed website resembling the original, where any login credentials or banking details you enter go directly to hackers.

2.      Spear Phishing & Offshoots

Traditional email phishing relies on sending a large number of emails to random recipients, hoping someone will fall for the scam. In contrast, spear phishing targets specific individuals, most commonly company employees, by gathering personal information and establishing trust.

Regular spear phishing can target anyone within a company. For example, attackers might use a mid-level employee’s digital footprint—like social media activity or publicly available information—to personalize phishing emails and make them appear more relevant and convincing. In these emails, attackers may request login details or internal contacts, making it easier to infiltrate and compromise the company.

Spear phishing offshoots, like whaling, take these attacks to the executive level, focusing on C-suite targets. While the approach is similar, whaling attacks may involve months of research and past data breaches to create convincing, professional messages that could fool even CEOs.

Another type of spear phishing is business email compromise (BEC). This phishing method involves cybercriminals impersonating high-ranking officials, partners, or suppliers to prompt action from lower-level employees.

The city of Saskatoon had a taste of BEC in 2019 when an attacker, posing as the CFO of a construction company, convinced city employees to transfer $1 million to a new bank account. This transaction was blocked in time, but most victims aren’t as lucky.

3.      Angler Phishing

Unlike traditional cybersecurity threats, angler phishing targets social media users. Cybercriminals monitor business accounts, focusing on users who post complaints or request help. They then create fake profiles resembling official customer service accounts and reach out to these users, offering “assistance” to resolve their issues.

Such fake accounts typically contact users via private messages, building trust by appearing responsive and helpful. Attackers may request details related to the user’s product or service order—such as account information, order numbers, or login credentials. Posing as support, they direct users to malicious links or request personal information, which can be used for identity theft, account hacking, or fraud.

4.      Smishing & Vishing

Some phishing attacks specifically target mobile users. Smishing, for example, uses text messages to impersonate trusted companies, promising recipients enticing opportunities or problem resolutions if they click on accompanying links.

There’s also vishing, or voice phishing, which are fraudulent phone calls based on social engineering and emotional manipulation. This type of phishing is becoming a major concern with the integration of AI, which now has an uncanny ability to mimic voices.

In such phishing cases, malicious cybercriminals now employ AI to imitate the voices of targets’ family members, pressuring them to take immediate actions, like wiring money or revealing personal information for identity theft.

5.      Search Engine Phishing

Search engine phishing exploits how search engines operate. Cybercriminals create seemingly legitimate websites and use standard SEO practices to rank them at the top of search results.

With these high rankings, fake websites replicating banks, tech companies, or e-commerce stores appear at the top of search results, leading regular users to click on them and unknowingly share their information with cybercriminals.

How Can You Avoid Phishing Scams?

While staying attentive to the links you click and attachments you download is the best way to avoid phishing scams, some cybersecurity tools can further reduce your risk.

Ensure your accounts are secure

Start by improving your login security, as one compromised password can put multiple accounts at risk if reused. Using a password manager for Mac, Windows, or mobile devices can help by generating strong, unique passwords for each account and storing them securely in an encrypted vault. Many also offer features like two-factor authentication, providing an extra layer of protection across all your devices.

Verify sources

Be cautious about where you enter personal data, and always verify website domains or email links against official sources. If this seems too time-consuming, a reputable VPN can help by blocking access to known malicious sites. VPNs are also useful on vulnerable networks like public Wi-Fi, where they keep your activity and credentials safe.

Keep a low profile

Limit the personal information available about you online. Set your social media accounts to private, and use data removal services to clear personal details from data brokers. This reduces your visibility to cybercriminals, making it more difficult for them to craft personalized scams. If you’re concerned about identity theft, ask yourself, “How do I check to see if someone is using my Social Security number?” Start by reviewing your credit reports, monitoring your financial accounts, and setting up fraud alerts to protect your identity.

Be mindful

Lastly, if in doubt, trust your instincts. Verify unexpected messages, and be cautious of requests for information that a legitimate sender wouldn’t usually ask for.

While a major online issue, phishing isn’t likely to vanish from the internet any time soon. Stay informed about different types of phishing scams and protect your privacy to avoid becoming a target.