The act of tricking individuals into divulging their sensitive information and using it for malicious purposes is not new. Social engineering attacks have occurred on the internet throughout its existence. Before widespread use of the internet, criminals used the telephone to pose as a trusted agent to acquire information. The term “phishing” has origins in the mid-1990s, when it was used to describe the acquisition of internet service provider (ISP) account information. However, today the term has evolved to encompass a variety of attacks that target personal information. For this paper, we will focus on crimes targeting personal information used for financial fraud and identity theft.

Criminals targeting user information are able to profit from the increased adoption of online services for many day-to-day activities, including banking, shopping, and leisure activities. Users of these services provide a target of opportunity in that they possess information of value.

Along with an increase in the number of potential targets, there are three major factors that criminals have been able to take advantage of:

Unawareness of threat - If users are unaware that their personal information is actively being targeted by criminals, they may lack the perspective needed toidentify phishing threats and may not take the proper precautions when conducting online activities.

Unawareness of policy - Phishing scams often rely on a victim’s unawareness of organizational policies and procedures for contacting customers, particularly for issues relating to account maintenance and fraud investigation. Customers unaware of the policies of an online merchant are likely to be more susceptible to
the social engineering aspect of a phishing scam, regardless of technical sophistication.

Criminals’ technical sophistication - Criminals conducting phishing scams are leveraging technology that has been successfully used for activities such as spam, distributed denial of service (DDoS), and electronic surveillance. Even as customers are becoming aware of phishing, criminals have responded with technical tricks to make phishing scams more deceptive and effective.