Phishing and Scams
Phishing is when an attacker pretends to be someone you trust to trick you into giving away passwords, codes or money.
What is Phishing?
The word comes from "fishing": the attacker throws out bait and waits for someone to bite. The bait can be an email, an SMS, a WhatsApp message, a social media post or a phone call.
| Type | Channel | Example |
|---|---|---|
| Email phishing | "Your account will be closed, log in here" | |
| Smishing | SMS | "Your parcel is held, pay Rs 150 customs fee at this link" |
| Vishing | Phone call | "I am calling from your bank, tell me the code we sent" |
| Spear phishing | Any, but personal | A message using your real name, boss's name and job details |
| Fake prizes | Social media, WhatsApp | "You won a free phone in a lucky draw, pay delivery charges" |
Warning Signs
Most phishing messages share some of these signs:
- Urgency or fear: "within 24 hours", "account blocked", "legal action"
- Too good to be true: prizes, huge discounts, easy jobs paying in dollars
- Requests for secrets: passwords, PINs, OTP codes, CNIC photos
- Strange sender: a bank email from a Gmail address, or an unknown number
- Odd links: misspelled domains or long, random addresses
- Spelling and grammar mistakes, although good scammers write well too
Reading a Link Carefully
The most important part of a web address is the domain: the part just before the first single /. Look at it from the right.
Example
https://www.mybank.com.pk/login real: domain is mybank.com.pk
https://mybank.com.pk.secure-login.xyz/ fake: domain is secure-login.xyz
https://www.mybannk.com.pk/login fake: "bannk" is misspelled
http://192.0.2.15/mybank/ suspicious: a bare IP addressWhatever comes before the real domain can be anything the attacker likes. In the second line, mybank.com.pk is only a sub-name of secure-login.xyz.
Checking a Link with Python
Developers can pull the real host name out of a link with Python's urllib:
Example
from urllib.parse import urlparse
links = [
"https://www.mybank.com.pk/login",
"https://mybank.com.pk.secure-login.xyz/verify",
]
for link in links:
print(urlparse(link).hostname)www.mybank.com.pk mybank.com.pk.secure-login.xyz
The second host ends with secure-login.xyz, so it does not belong to the bank.
On a phone, press and hold a link to see the full address before opening it. On a computer, move the mouse over the link and look at the bottom corner of the browser.
Checking an Email's Sender
The name shown on an email can be fake. Look at the actual address. In Gmail, click the small arrow next to the sender, or open Show original to see the email headers:
Example
From: "Bank Support" <support@mybank-alerts.top>
Reply-To: helpdesk7781@gmail.com
Authentication-Results: spf=fail; dkim=none; dmarc=failHere the display name says "Bank Support", but the address uses a strange domain, replies go to a Gmail account, and the SPF, DKIM and DMARC checks failed. This email is fake.
Safe Habits
- Do not click links in unexpected messages. Open the app or type the website address yourself.
- Call the company back on the number printed on your card or their official website.
- Never share OTP codes, PINs or passwords with anyone.
- Be careful with QR codes from unknown sources; they are links too.
- Ask a family member or colleague when you are unsure. Scammers want you to act alone and fast.
If You Clicked or Shared Something
Act quickly:
- Shared a bank or wallet detail: call your bank's helpline at once and block the card or account
- Entered a password: change it immediately on the real website, and anywhere else you used it
- Shared a WhatsApp code: set up WhatsApp again on your phone and turn on two-step verification
- Installed a file or app: disconnect from the internet and scan the device
- Report it: in Pakistan, cyber crime can be reported to the national cyber crime authority (formerly the FIA Cyber Crime Wing)
Exercise
Exercise
You get an SMS: "Your bank account is suspended. Verify now at https://mybank.com.pk.account-check.info". What is the real domain of this link?