What is phishing, and why is it a crime?

Ever get an email message from your bank, school or company that seems a little weird, or asks for personal information? It could potentially be a phishing scam, which may be more prevalent now during the COVID-19 crisis.

Phishing definition

Phishing is a form of cyber attack that usually uses email as a way to get unwilling recipients to give up personal information such as bank account details, usernames and passwords, social security numbers, and more. The alleged phisher can then use that information to access the email recipient’s personal accounts and potentially much more information that can be used to steal money or someone’s identity.

Phishing attacks are disguised as a trusted entity to make the recipient click on a link in an email. It could be a message that seems to be from a company or a person you may do business with — the more familiar the alleged correspondence is, the more likely those perpetrating these crimes will get information from their victims.

Increase during times of crisis

Those looking to engage in a phishing scam rely on deception and creating a sense of urgency to get their alleged victim to click on a link in an email or type their information in. The current COVID-19 crisis presents an opportunity as people are looking for guidance and answers from the government, their workplace, and even companies like Apple or Facebook that are used for communication.

An email appearing to be from work or imploring you to take action or pay more money for a service might receive less scrutiny as many people are trying to maintain normalcy. One click later and they could be compromising their accounts and personal information, and potentially infecting their device.

Attacks growing sophisticated

Phishing is a scam as old as popular use of the internet and those perpetrating it have adapted over the years at light speed to create sophisticated ruses.

An alleged attacker usually creates spoof emails that appear to be from trusted brands. Emails are formatted to look professional with company logos and text, and can use the victim’s name so it seems like the message is legitimate. The victim clicks on a link in the email and will often input their username and password or other sensitive information, and then it’s in the hacker’s hands. Often emails like this are sent to millions of people to ensure that at least a number of recipients will click on the bad link and provide their info.

Other messages may implore the victim to open a seemingly important attachment in the email message. Often, these attachments are riddled with malicious code and ransomware, which can encrypt a victim’s files. The phisher then demands a ransom to restore full access to the files.

Criminal charges

If you are charged with a phishing scam, New York State law considers the attack a crime based on impersonation of a business or individual, sending requests for money and fraudulent wire transfers, misrepresentations in business communications, and more. Most often you could be charged with criminal impersonation in the second degree or scheme to defraud in the first or second degree, among potential other charges like identify theft and unlawful possession of personal identification information.