Phishing — is a type of fraud in which scammers trick people into giving away their own information: usernames and passwords, SMS verification codes or card details. To do this, scammers impersonate someone the person trusts: a bank, social network, support service or someone they know.
The word comes from the English word fishing — «catching fish». A scammer casts «bait» in the form of an email, message or link and waits for someone to take it.
How phishing works
It usually starts with a message that looks official and demands urgent action. For example: «Your account will be blocked in 24 hours. Confirm your details using this link». The link leads to a fake website that looks exactly like the real one. The person enters their username and password, and the information immediately falls into the scammers' hands.
Phishing most commonly comes through:
-
an email pretending to be from a bank, social network or online service;
-
a message in a messenger app, sometimes sent from a hacked account belonging to someone you know;
-
ads or search engine results that lead to a fake website;
-
a phone call where a «bank employee» asks you to provide an SMS verification code.
How to recognize phishing
-
The website address or email address differs from the real one, sometimes by just one character: for example, faceb00k instead of facebook.
-
You're pressured to act quickly and threatened with account suspension, fines or money being withdrawn.
-
You're asked to enter information that a legitimate service would never request in this way: an SMS verification code, password or two-factor authentication code.
-
You receive an unexpected link even though you haven't requested anything.
If you're unsure, don't follow the link in the message. Instead, open the service's website yourself using a bookmark or by manually entering its address.
Phishing in traffic arbitrage
Affiliate marketers — are frequent phishing targets because they have assets that can easily be turned into money: ad accounts with linked payment cards, Business Managers and pages. Once scammers gain access to them, they can run ads at someone else's expense or take over the account.
The most common tactics include:
-
emails supposedly from Facebook or Instagram warning about policy violations and an upcoming account suspension, with a link to an «appeal» that leads to a fake website;
-
partnership requests in Business Manager from unfamiliar business accounts. Such an email comes from the real Meta, making it easy to trust, but if you accept the request, an outsider will gain access to your ad accounts and pages;
-
theft of login credentials stored in the browser, after which scammers don't even need a password.
Important: if you receive an email about an account suspension, don't follow the link. Instead, log in to your account directly and check the notifications there. Don't accept unknown partnership requests in Business Manager.
