Phishing

What Is Phishing?

Phishing is a social engineering attack in which a criminal impersonates a trusted organization or person to trick the victim into revealing sensitive information, installing malware or sending money. The disguise might be a bank, a tax authority, a delivery company, an employer, a supplier or a family member. The bait is usually a message that creates urgency or fear: a blocked account, a missed parcel, an unpaid invoice, a security alert.

The term originally described fraudulent emails, but it now covers any channel where a message can be faked, including SMS, messaging apps, voice calls, social media, search advertisements and QR codes. In financial services, phishing is one of the most common starting points for account takeover, payment fraud and identity theft.

Why Phishing Matters

Phishing works because it targets people rather than systems. A well-protected bank can still lose customer funds if a customer hands over a login and a one-time passcode to a convincing fake website. For financial institutions, the consequences include:

• Customer losses through unauthorized transactions or authorized push payments made under deception.
• Account takeover when stolen credentials are used to access online banking, email or mobile wallets.
• Data breaches when staff are phished and attackers gain access to internal systems.
• Brand abuse, since criminals copy the institution's logo, tone and web design.
• Laundering exposure, because phished funds usually flow through mule accounts at the same or other institutions.

Common Types of Phishing

• Mass phishing: generic emails sent to large lists, relying on volume.
• Spear phishing: targeted messages using personal details about the victim to look credible.
• Whaling: spear phishing aimed at senior executives or people with payment authority.
• Smishing: phishing by SMS, often with a short link to a fake login page.
• Vishing: phishing by voice call, sometimes with a spoofed caller ID showing the bank's real number.
• Business email compromise (BEC): impersonation of an executive, supplier or lawyer to redirect a payment to a criminal-controlled account.
• Clone phishing: a copy of a legitimate message the victim already received, with the link or attachment swapped.
• Quishing: QR codes on letters, posters or emails that lead to phishing sites.
• Adversary-in-the-middle phishing: a proxy site that relays the real login page and captures credentials and session cookies, defeating many one-time passcode schemes.

Red Flags for Customers and Staff

• Pressure to act immediately, or a threat that an account will be closed.
• A request for a password, PIN, full card number or one-time passcode, which genuine institutions do not ask for by message or phone.
• A sender address or domain that differs slightly from the real one.
• Links whose destination does not match the displayed text.
• Unexpected attachments, especially archives or documents asking to enable macros.
• A call from "the fraud team" instructing the customer to move money to a "safe account".
• A supplier email announcing new bank details just before a payment is due.

Red Flags in Transaction Data

Phishing usually becomes visible to an institution through its after-effects. Signals include a login from an unfamiliar device or location soon after a password reset, a new payee created and paid within minutes, payments to accounts recently opened at another institution, and several unrelated victims sending money to the same beneficiary.

Controls and Defenses

1. Phishing-resistant authentication: passkeys and hardware-backed authenticators bound to the real domain are much harder to phish than SMS codes.
2. Transaction-aware approvals: authentication prompts that show the payee and amount make it harder for a customer to approve a fraudulent payment unknowingly.
3. Email authentication: publishing SPF, DKIM and DMARC records reduces spoofing of the institution's own domain.
4. Takedown and monitoring: watching for lookalike domains, fake apps and fraudulent advertisements, and requesting their removal.
5. Payee checks and cooling-off periods: confirmation of the payee name and delays for first-time high-value payments give customers time to reconsider.
6. Staff training and simulations: regular exercises focused on payment redirection and credential requests.
7. Customer education: consistent messaging about what the institution will never ask for.

Regulatory Expectations

Phishing is addressed through several frameworks. In the European Union, the revised Payment Services Directive (Directive (EU) 2015/2366) requires strong customer authentication, including dynamic linking of authentication to the amount and payee for remote electronic payments. In the United Kingdom, rules on reimbursement of authorized push payment scam victims place financial responsibility on sending and receiving payment firms, giving both a strong incentive to detect scams. In the United States, FinCEN has published advisories on business email compromise and expects financial institutions to report related suspicious activity under the Bank Secrecy Act.

Where phishing proceeds pass through customer accounts, firms are generally expected to investigate, consider suspicious activity reporting and act on the receiving accounts.

How on8.ai Helps

on8.ai's Pre-KYC checks assess email, phone and IP risk, along with velocity and bot signals, before an account is opened. This helps institutions filter out accounts set up to receive phished funds before they become active.

Related Terms

• Account Takeover (ATO)
• Identity Spoofing
• Money Mule
• Dark Web Monitoring
• Zero-Day Fraud