Phishing

A message by email or SMS claims to come from a bank, card company, online shop, delivery company or mobile carrier and leads to a fake copy of its site. Whatever the visitor types there, such as IDs and passwords, card numbers, PINs (the short secret numbers for a card or bank account) or one-time passwords, goes straight to the attacker. [1] [2]

Most messages push for quick action, warning of a detected break-in or a suspended account, and some lure people through ads shown in search results instead. Some ask the reader to install an app, such as a fake parcel tracker, that is malware. [1]

Against organizations, a common form copies the login page of staff email or a cloud service. A stolen account is then used to forward incoming mail to the attacker or to send new phishing emails to partners and other contacts. [4]

• An account is taken over, money is transferred out of a bank account, or goods are bought in the victim's name. [1]
• A credit card is used fraudulently. [1]
• Once malware gets onto a phone, its contacts can be stolen and the phone itself can start sending phishing SMS. [1]
• When a staff account is taken over, mail and contacts can be stolen, and emails posing as that employee go out to others. [4]

• The message urges you to open a link at once, citing a suspended account, a break-in or similar. [1]
• It asks for your ID or password by email or SMS. Banks never ask for these that way. [1]
• An email asks you to open a link although you started no request yourself. [4]

These signs are not enough. Sender names and addresses are easy to fake, the text may be copied from real messages or written in fluent Japanese, and fake sites can show the padlock beside the address too. Looks alone rarely tell them apart. [1] [3]

• Change the password you entered at once, on every service where you use it. [1]
• Report fraudulent transfers to your bank and card misuse to your card company; they may have compensation schemes. [1]
• Report the damage to a police station or the police online desk, and report the fake site to the Internet Hotline Center's phishing desk. [1]
• For an organization's account, besides changing the password, check that no settings the attacker changed, such as mail forwarding, remain. [4]

Incidents whose sources name phishing, or another trick that gets people to hand over information, carry the method Phishing. It can appear alongside other methods, as when a phished account led to a ransomware attack.

The incident list can be filtered by method.