# data[].attributes.attachment_link.title
Cybercrime: £130bn stolen from consumers in 2017, report says

# data[].attributes.attachment_link.description
Of the 978m global victims of cybercrime last year, 17m were Britons targeted by phishing, ransomware, online fraud and hacking

# data[].attributes.attachment_link.title
2018 Phishing and Fraud Report: Attacks Peak During the Holidays

# data[].attributes.attachment_link.description
Phishing attack? Absolutely. Success? Likely. Risk of incident? High. Breach costs? About $6.5 million.

# data[].attributes.attachment_link.title
Man jailed for phishing scam that targeted UK students to steal £1.5m

# data[].attributes.attachment_link.description
Olajide Onikoyi was among number of criminals who targeted students by sending emails about student loan accounts

# data[].attributes.attachment_link.readable_text
YOU HAVE to be pretty naive to fall for a phishing attack, particularly one that asks you to transfer money into an account or give up any of your bank details.

The idea behind phishing is simple: get someone to click on a bogus link in an attempt to acquire sensitive information or access to systems.

Nearly 100,000 people reported receiving phishing emails in 2015 in the UK alone, which equates to nearly 8,000 a day. And phishing attacks apparently work nearly half of the time, which is staggering.

Here's a list of some of the biggest phishing attacks so far.
5. The UK's biggest phishing scam

The Met Police's Action Fraud unit estimated that £59m worth of fraud was prevented in the UK after three men were convicted of launching sophisticated phishing scams to access the accounts of bank customers in 14 countries.

About 2,600 phishing pages that mimicked banking websites were analysed by the Met Police Central e-Crime Unit (PCeU), the Serious Organised Crime Agency and the US Secret Service.

The men behind the scam were traced to the UK, where they stayed in plush hotels in London while continuing to scam victims.

Perhaps a little too comfortable in their luxury surroundings, they were caught red-handed at the hotel using laptops to log into servers storing compromised banking data.

Officers later discovered servers containing details of 30,000 bank customers, 12,500 of which were in the UK, and 70 million customer email addresses to be used in phishing scams.

The men were jailed for a total of 20 years. Investigating officer DI Jason Tunn said at the time that it was the "biggest case the PCeU has dealt with to date and is likely to be the biggest cyber phishing case so far in the UK".

# data[].attributes.attachment_link.title
Top 5 biggest phishing scams | TheINQUIRER

# data[].attributes.attachment_link.description
YOU HAVE to be pretty naive to fall for a phishing attack, particularly one that asks you to transfer money into an account or give up any of your bank details.

# data[].attributes.attachment_link.title
Cyber Law - Prevention and Regulation of Phishing in Cyber-Space National and International Framework

# data[].attributes.attachment_link.description
Cyber Law - Prevention and Regulation of Phishing in Cyber-Space National and International Framework

# data[].attributes.attachment_link.readable_text
Nation states. Hacktivists. Cyber criminals.

There are so many players in the modern threat landscape it can be hard to keep up.

And the number of threats? Practically too many to count.

By the time you've secured your organization against password reuse, DDoS, and crimeware attacks, your resources are likely so diminished there's no point even thinking about what else could be out there.

But there's a problem. An elephant in the room, if you like.

There's one threat vector that gets minimal attention, and even less budget... and yet is a common factor in almost every data breach you've heard about in the last decade.

Threat actors have used phishing for years as their go-to initial infection vector. Why? Because it works. To find out how your organization can mitigate the threat of phishing using powerful security awareness training, register for our free on-demand webinar: Best Practices for Phishing Awareness Training

The Experts' Take

Now look. We sit here all day, and think about how we can protect our customers from phishing. Of course we think it's a big deal.

But you don't have to take it from us that phishing should be at the top of your cyber concerns. Instead, take it from a bunch of other security experts who have no real stake in whether or not you decide to care about it:

"A single spear-phishing email carrying a slightly altered malware can bypass multi-million dollar enterprise security solutions if an adversary deceives a cyber-hygienically apathetic employee into opening the attachment or clicking a malicious link and thereby compromising the entire network."

― James Scott, Senior Fellow, Institute for Critical Infrastructure Technology
"Almost every breach you read about happens through spear phishing, and the weak link is the human behind the keyboard. Spear phishing always, always works."
- Anup Ghosh, CEO, Invincea

Convinced yet? No? Fair enough. Let's take a look at some empirical data instead.

5 Reasons To Start Taking Phishing Seriously

1) The volume of spam emails increased by 400 percent in 2016

Now, of course, not all spam is malicious. In fact, a huge proportion of it is just... well... spam.

But it wasn't just spam that increased. In addition to a huge spike in overall spam volume, the proportion of spam emails containing malicious attachments skyrocketed as well.

And we're not just talking about ransomware... in recent years phishing has been the number one distribution method for all malware, at around two-thirds of total distribution.

2) More than 400 businesses are targeted with business email compromise (BEC) scams every day

If you thought malicious attachments were the only trick up phishing actors' sleeves, think again. BEC scams, which spoof trusted email addresses to demand immediate payment of fraudulent invoices, have become hugely popular in recent years.

Does that sound like something that would never work? Unfortunately, it does, and in a big way.

3) Volume of W-2 phishing lures increased 870 percent during the early months of 2017

W-2 scams are a subset of BEC, whereby phishing actors pose as senior company executives and request employee W-2 forms from payroll or HR employees for the purposes of committing tax fraud. Naturally, this type of scam is typically confined to the first few months of the year.

But here's the thing. This statistic isn't really about W-2 scams... it's about the tendency of phishing actors to constantly change targets and tactics to ensure a consistent (and very high) level of success.
4) Phishing volume grew by a massive 41 percent in Q2 2017

Over the past decade we've observed many industries being completely blindsided by a sudden torrent of phishing attacks, simply because one or two phishing actors identified an opportunity, and the rest followed suit. In recent years, this exact process has happened to the SaaS, online services, payment services, cloud services, e-commerce, and financial industries... and right now, nobody knows who will be next in line.

We've been observing phishing trends for over a decade, and in all that time volume has only ever gone up. But 41 percent in a single quarter? That's huge.

But you know what? It's not surprising. Not really.
5) Almost half of all breaches are caused by phishing

After all, with all the fancy new security products on the market, traditional hacking techniques aren't as easy to pull off as they were a few years back. Even mid-sized businesses are rocking some pretty advanced security technologies.

But fooling people? That never goes out of style.

That's right. We saved the best for last.

A massive 43 percent of all reported breaches utilize phishing. Do I really need to say anything more?

If one threat vector accounts for almost 50 percent of all cyber risk, I'd say it's about time we all start taking it more seriously.

Time to #FightBack

I hope, by this time, you're convinced that phishing is a real problem, and one that needs to be addressed if your organization is going to keep hold of its sensitive data.

After all, by 2020 a quarter of the world's population will have been affected by data breaches... do we really need to make things even worse?

Thankfully, there are plenty of things you can do to minimize your organization's level of phishing risk. Last October, in honor of National Cyber Security Awareness Month, we put together a bundle of free resources to help organizations and individuals fight back against phishing, including:

"How To Spot a Phish" video series

9 detailed blog post on the most common types of phish

7 webinars on phishing best practices, trends, and advice

5 white papers on everything from enterprise phishing protection to our SAT buyer's guide

# data[].attributes.attachment_link.title
The Impact of Phishing, and Why it Should be Your #1 Priority

# data[].attributes.attachment_link.description
Nation states. Hacktivists. Cyber criminals. There are so many players in the modern threat landscape it can be hard to keep up. And the number of threats? Practically too many to count. By the time you've secured your organization against password reuse, DDoS, and crimeware attacks, your resources are likely so diminished there's no point even thinking about what else could be out there.

# data[].attributes.attachment_link.readable_text
Skip to content

How to Avoid being phished

What is Phishing?

phish·ing noun \ˈfi-shiŋ\ : Phishing is an email scam that attempts to obtain sensitive information from unsuspecting users.
Phishing Video Transcript
How to spot phishing:

A phishing email will attempt to trick you in one of five ways:

1. The Old Fashion Scam: In this type of phishing message, the bad guy will typically just make a direct request for personal information or money. The bad guy will ask that you reply to the email and will then start a dialog with you in an attempt to gain your trust. The bad guy will have a very detailed cover story and will constantly press you to provide more information or to send the bad guy money.

2. A Fake Link: The phishing message may contain a link which takes you to a fake website or which downloads a virus on to your computer. To avoid this, you should always stop and think before you click on a link. Did you expect to receive the message in the first place? Hover your mouse over the link and verify that it is taking you where you want to go. Links can be deceiving. Hover your mouse over the following link and see that the destination is not what is described by the link text: http://www.gatech.edu/. If you are viewing the link on a smartphone, holding your thumb on the link should reveal the actual destination of the link. Please note that 99.5% of all legitimate Georgia Tech websites will have a domain that contains "gatech.edu" (e.g. https://passport.gatech.edu ).

3. A Fake Website: If you received a phishing email with a fake link, you may have clicked the link and it took you to a website asking for your information. To learn how to identify a legitimate website, please read the following: https://faq.oit.gatech.edu/content/how-identify-legitimate-website. If you receive an email that you think wants you to go to a fake website, one strategy is to manually go to your web browser and manually type in the actual URL of the website you are looking for. For example, if you receive an email from what appears to be your bank asking you to click a link and enter your login and password, instead of clicking the link, go to your browser and manually navigate to your banks website. You can also call someone to verify if the message is real. Following the previous example you can call your bank directly and ask if they actually need to verify your information.

4. A Virus Attachment: If you receive a phishing email with an attachment, the attachment most likely contains a virus which will then either send your information to the bad guys, or allow the bad guys to access your computer. Stop and think before you open any attachments. Did you expect to receive the attachment from the sender? Often times the bad guys will pretend to be people you know and trust in order to get you to trust the attachment. If the email and attachment is from an unknown source, delete the email immediately. If the email and attachment appear to be from a trusted source, but not expected, pick up the phone and call the person to verify if they actually sent you the message.

5. Fake Contact Information: If you receive a phishing message which contains a phone number asking you to call if you have questions, this could also be a scam designed to further gain your trust. Don't trust the contact information contained in the email. Navigate to the actual website of the organization in question and obtain their contact information directly from their website.

The biggest thing to remember is that you should never share your login and password with anyone... for any reason... ever.

Why do we concentrate our efforts on phishing training?

Georgia Tech receives 3 million email messages per day

Approximately 90% of email received is spam, phishing, or malware

We want to present a real life phishing message that was recently seen

Historically we have found 15-20% of people fall for phishing the first time we send it, but through regular training exercises departments have seen that drop to under 2%.

Reporting Phishing:

If you receive a message which you suspect may be a phishing attack forward the message as an attachment to phishing@gatech.edu.
How to forward a message as an attachment

# data[].attributes.attachment_link.description
Skip to content How to Avoid being phished What is Phishing? phish·ing noun \ˈfi-shiŋ\ : Phishing is an email scam that attempts to obtain sensitive information from unsuspecting users. Phishing Video Transcript How to spot phishing: A phishing email will attempt to trick you in one of five ways: 1.

# data[].attributes.attachment_link.description
Phishing? It's likely your employees are being targeted by daily phishing attacks. What you need to know about the corporate impact of phishing.