What is phishing?
A comprehensive guide to phishing attacks: the definition, the types (spear phishing, whaling, vishing, smishing), how to recognize a phishing attack, and how to protect yourself from the theft of sensitive information and login details
* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.
Key definitions
Phishing
An internet fraud attack based on impersonating a trusted party (a bank, a company, a government institution) in order to steal sensitive information such as usernames and passwords, login details or financial details.
Phishing (in Hebrew: "dayig")
The Hebrew translation of the term phishing - fishing for victims with a digital "bait". The term describes the method: casting a wide net and "fishing" for victims who will swallow the bait.
Impersonation
A central attack technique in phishing - an attacker impersonates a legitimate party: a bank, a credit company, a government service, a well-known company, or even a friend or colleague at work.
Phishing attack channels
How attackers carry out phishing and impersonation attacks
Email phishing
The most common channel - fake emails that impersonate legitimate organizations and contain a link to a fake website or a malicious attachment. Warning signs: a suspicious sender address, artificial urgency, spelling mistakes.
Examples: 'Your bank account has been blocked', 'Your package is waiting', 'Reset your password'
SMS messages (smishing)
Phishing by text message - the attacker sends an SMS that impersonates a bank, a delivery company or a government authority. It contains a fake link or a phone number to call. People tend to trust an SMS more than an email.
Examples: 'Your package is waiting - click here', 'Your account has been blocked - act immediately', 'You won a prize'
Phone calls (vishing)
Voice phishing - an attacker calls and impersonates a bank representative, technical support or a government authority. They use social engineering to create urgency or fear and ask for login details or actions on the computer.
Examples: 'A representative from the bank - there is suspicious activity', 'Microsoft technical support', 'the Ministry of the Interior'
Fake websites
Login pages or forms that imitate legitimate websites - banks, social networks, email services. The domain is usually very similar (with a small spelling mistake) and has no valid security certificate.
Examples: gooogle.com instead of google.com, paypa1.com instead of paypal.com
Types of phishing attacks
From mass phishing to sophisticated targeted attacks
Spear phishing
A phishing attack aimed at a specific person or organization. The attacker invests time in in-depth research: role, contacts, interests, details from social networks. The email looks personal and very relevant - harder to recognize.
Whaling
Phishing aimed at senior executives - CEO, CFO, directors. The "whales" are attractive targets because of their access to critical information and authority to transfer funds. Whaling attacks are very sophisticated.
Clone phishing - duplicating emails
Duplicating a legitimate email the victim received in the past, replacing links or files with malicious versions. It is sent from a very similar address with an excuse such as 'resending'. Because the email is familiar, the chance of success is high.
BEC - Business Email Compromise
Impersonating senior executives or business partners in order to transfer funds or expose sensitive information. For example: a fake email from the CEO to the finance manager. It causes losses of billions of dollars a year.
How do you recognize a phishing attack? Warning signs
10 signs that indicate a suspicious email, SMS or call
How do you protect yourself from phishing?
8 steps for effective protection from the theft of information and login details
Do not click links in suspicious emails
Do not click links in unfamiliar emails. Hover over the link to see the real address before clicking.
Check the sender's address and domain
Carefully check the sender's email address and domain. Watch for small spelling mistakes (gooogle.com instead of google.com).
Do not enter login details on websites without HTTPS
Make sure the site is secure (HTTPS + a padlock in the browser) before entering login details. Check the address in the browser bar.
Use two-factor authentication (2FA)
Enable two-factor authentication on all critical services. Even if a password is stolen, the attacker will not be able to log in.
Update your antivirus and browser
Keep your antivirus, operating system and browser updated. Updates close security holes.
Do not download attachments from unfamiliar sources
Be careful with email attachments, especially .exe, .zip and .js. Do not open files from unfamiliar sources.
Contact the organization directly to verify
If in doubt, contact the organization through another channel (phone, official website) to verify. Do not use a number or link from the suspicious email.
Use a password manager
A password manager automatically recognizes fake sites and will not fill in login details on a wrong site.
Phishing - a detailed explanation
Phishing, is an internet fraud in which an attacker impersonates a legitimate party (such as a bank, a credit company or Israel Post) using SMS, email or WhatsApp messages, to get the victim to click a malicious link and hand over sensitive information such as passwords, credit card details and account details, or to download malware. The messages create a sense of urgency (for example, "your account has been blocked") and lead to impersonating websites that look identical to real ones.
How does it work?
- •Impersonation: The attacker sends a message that looks as if it came from a familiar body (a bank, a telecom company, the National Insurance Institute, the post office).
- •The bait: The message contains a link to a fake website, with a reason to click it (for example, updating details or paying for a delivery).
- •Data theft: On the fake website you are asked to enter personal details (a password, an ID number, credit card details), and the attacker steals them.
How do you protect yourself?
- Suspicion: Always treat messages that ask for personal information or a click on a link with suspicion, even if they look legitimate.
- Check the address: Verify the website address before entering details (do not click a link; type the address manually).
- Do not hand over details: Never send sensitive details by email or through a link.
- Contact them directly: If in doubt, contact the relevant organization directly through its official channels (a website or a phone number), and not through the link in the message.
- Security software: Use antivirus and malware detection software.
- Changing passwords: Change passwords regularly.
What to do if you fell victim?
- Change your passwords: Immediately change the passwords on all accounts whose details appear to have been stolen.
- Report to the bank or credit company: Notify the bank or the credit company about the breach.
- Report to the police: Report the incident to the police (you can do so through the government call center, 119).
More information on phishing attacks and phishing scams
Phishing attacks are one of the main information security threats today. These scams include impersonating financial institutions, banks, credit companies, government services, and even friends and colleagues at work. Attackers use social engineering and psychological manipulation to get victims to hand over login details, passwords, usernames, financial details, bank account details and credit card details.
Phishing attacks are carried out through email, SMS messages (smishing), phone calls (vishing), and messaging apps such as WhatsApp. Attackers create fake websites, fake login pages and fake forms that look identical to the real websites. They use fake domains with small spelling mistakes to mislead victims.
Fake links in phishing messages lead to impersonating websites where the user is asked to enter sensitive details. Sometimes these messages also contain malicious attachments that contain malware, viruses or spyware. The files can be in formats such as .exe, .zip or .js, and contain malware that infects the computer and gives attackers access to personal information.
Identity theft is a common result of phishing attacks. When attackers gain access to login details, they can impersonate the user, access accounts, transfer funds, and cause significant financial damage. In serious cases, the theft of sensitive information can lead to a computer breach, exposure of organizational information, and damage to the company's reputation.
Spam is one of the channels through which phishing attacks are carried out. Mass emails are sent to hundreds of thousands of recipients, a small share of whom may fall for it. Attackers use instant messages, social networks and every possible communication channel to reach potential victims. They exploit current events, holidays, marketing campaigns and crises to create a sense of urgency and increase the chance that the victim will click the fake link.
A security certificate (an SSL/TLS certificate) is one of the signs that a website is legitimate and protected. Websites without HTTPS and a padlock in the browser may be fake. However, fake websites can also obtain basic security certificates, so it is important to also check the domain and the website address carefully. Impersonating a bank or a financial institution is one of the most common techniques, because people tend to trust such messages and act quickly when money is involved.
Bank account details, credit card numbers, CVV codes, expiry dates and ID numbers are the main target of phishing scams. Attackers use this information to carry out unauthorized transactions, to sell the information on the dark web, or to commit full identity theft. It is important to remember that legitimate financial institutions will never ask for passwords or credit card details by email or SMS.
Information security training and employee awareness programs are essential for protection from phishing attacks. Organizations should run phishing simulation exercises regularly to test employees' readiness and identify weak points. These exercises help employees learn to recognize warning signs and respond correctly when they encounter a suspicious email, a suspicious SMS or a suspicious phone call.
Related terms
Information security
A broad field that deals with protecting information from unauthorized access, alteration, theft or destruction. Phishing is one of the main threats in information security.
Social engineering
Psychological manipulation of people to get them to reveal information or to perform actions. Phishing is a type of social engineering based on creating false trust.
More keywords
Real examples of successful phishing attacks
Documented cases that illustrate the danger and the importance of protection
A phishing attack on a leading Israeli bank (2023)
A large-scale phishing campaign that included sending thousands of emails and SMS messages impersonating a large Israeli bank. Victims received an urgent message about "an account block because of suspicious activity" with a link to a fake login page identical to the bank's website.
The method: SMS + a fake website with a domain similar to the bank's (with a slight change)
The result: Hundreds of customers entered login details and verification codes
The damage: Significant financial losses before the bank blocked the campaign
Lesson: never click links in messages from your bank. Go directly to the app or the official website.
A BEC attack on a technology company (2024)
An attacker impersonated the CEO of an Israeli technology company and sent an email to the finance manager with an urgent request to transfer funds to a "new" supplier abroad. The email was sent from an address very similar to the CEO's real address, with a small dot added in the domain.
The method: Impersonating a senior executive (CEO fraud) with a spoofed domain
The result: A transfer of $2.3 million to the attackers' account
The damage: Part of the money was not recovered, reputational damage, and a police investigation
Lesson: always verify requests for fund transfers by phone or in person, even if the email looks real.
The "Your package is waiting" campaign - a delivery company (2024)
Millions of SMS messages were sent to Israeli phone numbers with the text: "Your package is waiting at the distribution center. Click here to pay the delivery fee". The link led to a fake page of an Israeli delivery company that asked for credit card details.
The method: Smishing - SMS phishing impersonating a delivery company
The result: Tens of thousands of Israelis entered credit card details
The damage: Credit card data theft, unauthorized transactions, and many complaints
Lesson: legitimate delivery companies do not send SMS messages with payment links. Always go to the official website yourself.
Vishing - impersonating technical support (2023)
Victims received a phone call from the "technical support" of a large software company warning of "a dangerous virus on the computer". The attackers asked for remote access to the computer "to fix it", installed malware and stole sensitive information.
The method: Vishing - phone phishing with social engineering
The result: Full access to computers, installation of spyware and theft of passwords
The damage: Theft of banking information, access to accounts, and exposure of personal information
Lesson: large software companies do not call proactively. Never give remote access to someone who called you.
Advanced tips and technology tools for protection from phishing
Strategies and technologies that every organization should implement
Email authentication protocols
Implementing protocols such as SPF, DKIM and DMARC prevents attackers from sending fake emails from your domain. It protects both you and your customers.
- • SPF - defines which servers can send email from the domain
- • DKIM - a digital signature for authenticating emails
- • DMARC - a policy for how to handle emails that failed authentication
Multi-factor authentication (MFA)
Enable two-factor or multi-factor authentication on all critical services. Even if a password is stolen, the attacker will not be able to log in without the second factor.
- • Authenticator apps (Google, Microsoft)
- • Physical security keys (YubiKey)
- • Biometric confirmation (fingerprint, face recognition)
Email security solutions
Use advanced solutions for filtering and detecting malicious emails before they reach employees' inboxes.
- • Proofpoint, Mimecast, Barracuda
- • Behavioral analysis of emails
- • Protection from brand impersonation
A detailed guide: how to check whether an email is phishing
1Checking the sender's address
Click the sender's name to see the full email address. Look for:
- Similar domains with slight changes: paypa1.com instead of paypal.com
- Long and cumbersome domains: secure-bankhapoalim-verify-account.com
- The use of free email services: gmail.com, yahoo.com instead of the company's domain
2Analyzing the content and style
Pay attention to the quality of the writing and design:
- Spelling mistakes and poor wording in Hebrew or English
- A generic greeting: "Dear customer" instead of your own name
- Unprofessional graphic design or blurry images
3Checking links before clicking
Hover over the link (without clicking) and check:
- Does the real link match the displayed link?
- Is the domain right? (for example: bankhapoalim.co.il)
- Be careful with link shorteners (bit.ly, tinyurl) - you cannot know where they lead
4Recognizing time pressure and artificial urgency
Attackers create a sense of urgency so that you act fast and do not think:
- "Your account will be blocked within 24 hours if you do not act immediately"
- "We detected suspicious activity - verify your identity now"
- "A limited offer - only 2 hours left!"
Statistics and numbers: the global state of phishing in 2024-2025
Updated data from international studies
of organizations experience phishing attempts every year
of breaches involve impersonation or social engineering
An increase in vishing (phone phishing) attacks since 2022
of employees clicked a suspicious link in a phishing exercise
The average cost to an organization of a single phishing attack
dollars - the average ransom amount in ransomware attacks that began with phishing
hours - the average response time of an organization to a phishing attack
of employees who were exposed to a phishing exercise will fall for it again within a year
Trends and forecasts for the future
Rising trends in 2025
- AI-Powered Phishing: The use of artificial intelligence to create personalized and more sophisticated phishing emails, including voice spoofing (deepfake voice)
- QR Code Phishing: The use of malicious QR codes in public places, in emails and in messages
- Multi-channel attacks: A combination of email, SMS, phone and social networks in the same attack
- Phishing-as-a-Service: Platforms that let anyone launch a phishing attack easily
High-risk industries
- Banking and finance: 23% of all phishing attacks are aimed at this industry
- Healthcare: Medical records are an expensive target on the black market
- Government: Sophisticated attacks on government and military bodies
- Education: Less protected infrastructure and a lot of student data
A detailed comparison: types of phishing attacks
Understanding the differences will help you recognize threats better
| Type of attack | Channel | Level of sophistication | Target audience | Example |
|---|---|---|---|---|
| Regular phishing | Mass email | Low to medium | The masses | Mass emails impersonating a bank |
| Spear Phishing | Targeted email | High | A specific person or organization | An email impersonating a specific business partner |
| Whaling | VIP email | Very high | CEOs, CFOs, directors | A request to transfer funds from the "CEO" |
| Smishing | SMS | Medium | Wide | "Your package is waiting - click here" |
| Vishing | Phone | Medium to high | Private / business | Impersonating a bank representative on a call |
| Clone Phishing | Cloned email | High | Whoever sent or received a legitimate email | A copy of a real email with a replaced link |
| BEC | Executive email | Very high | Finance departments | A fake email from the CEO requesting a transfer |
Useful links - checking and reporting tools
Professional tools for checking suspicious links, emails and files
International tools
Have I Been Pwned
haveibeenpwned.com →Check whether your email or phone number was exposed in data breaches. A world-leading service.
VirusTotal
virustotal.com →Scanning of files, URLs and IP addresses with 70+ antivirus engines. Owned by Google.
URLScan.io
urlscan.io →An in-depth check of suspicious websites and links with a screenshot and technical details.
PhishTank
phishtank.com →A community database of verified phishing sites. Check whether a link appears in the database.
Google Safe Browsing
safebrowsing.google.com →Google's checking tool for dangerous websites and malware.
AnyRun
any.run →An interactive sandbox for running suspicious files in an isolated environment.
Reporting to authorities in Israel
The National Cyber Directorate hotline
gov.il →Report cyber incidents and online fraud to the Israeli National Cyber hotline.
Phone: 119
A government hotline for reporting phishing, fraud and cyber threats
Israel Police - cyber complaints
gov.il →File an official complaint with the police about internet fraud and data theft.
The Privacy Protection Authority
gov.il →Report data breaches and exposure of personal information.
The Bank of Israel - financial fraud
boi.org.il →Report phishing scams related to banks and credit cards.
Important to know
- •Report to the bank immediately if you entered details by mistake
- •Save screenshots of suspicious messages
- •A report to the police is required for insurance claims
- •Do not delete suspicious emails before reporting
Additional tools for checking and verification
Domain authenticity check
Website reputation check
Checking shortened links
Frequently asked questions and answers about phishing
Comprehensive answers to the most common questions
?Does antivirus protect against phishing?
Modern antivirus includes some protection from phishing, but it is not enough. It can block known fake websites and malicious files, but it will not detect new or sophisticated phishing emails. The best protection is a combination of technology + employee training + security protocols.
?What do I do if I clicked a suspicious link?
Act immediately: (1) disconnect the device from the internet/Wi-Fi, (2) scan the computer with antivirus, (3) change passwords from another device, (4) enable two-factor authentication, (5) check for suspicious transactions in your bank account, (6) report to your organization's IT team, (7) consider calling the bank/credit company. Do not log in to accounts from the device until you are sure it is clean.
?How do you know whether a domain is fake?
Check carefully: (1) small spelling mistakes (gooogle.com, paypa1.com), (2) unusual additions (-secure, -verify, -login), (3) long, strange domains, (4) unusual endings (.co.il instead of .com), (5) numbers used in place of letters. Always check in the browser for a padlock (HTTPS), but that is not enough - fake websites can also get an HTTPS certificate.
?Can they impersonate my bank's phone number?
Yes! This is called caller ID spoofing. Attackers can make a fake phone number appear on your screen, including the bank's official number. So even if you see a familiar number, do not rely on it. If someone calls and asks for sensitive details, hang up and call back the bank's official number (not the number that called you).
?Is phishing related to ransomware?
Yes, a close relationship! 90% of ransomware attacks begin with a phishing attack. The victim clicks a link or downloads a malicious attachment, the software enters the system, encrypts files and demands a ransom. So protection from phishing is in effect protection from ransomware.
?What are the legal consequences for an organization that experiences a phishing breach?
It depends on the country and the type of information exposed: (1) regulatory fines (GDPR, HIPAA), (2) class actions by customers, (3) directors' personal liability, (4) a duty to report to the authorities within 72 hours (GDPR), (5) compensation for injured customers, (6) loss of business licenses. In Israel, the Privacy Protection Law and Nabat 361 require appropriate protection and reporting of breaches.
?How do you protect employees who work from home?
A special challenge! (1) A VPN is mandatory for all access to the organization's systems, (2) no use of public Wi-Fi, (3) separation between a work computer and a personal computer, (4) periodic phishing training, (5) immediate reporting of suspicious emails, (6) multi-factor authentication on all systems, (7) automatic security updates, (8) a strong password policy.
?What is the difference between phishing and pharming?
Pharming is more advanced: instead of tricking you into clicking a link (phishing), pharming changes your DNS settings so that when you type the right address (for example bankhapoalim.co.il), you are redirected to a fake website. It is more dangerous because you do everything right but still end up on the fake website. Protection: (1) updated antivirus, (2) an updated browser, (3) checking the website's security certificate.
Phishing check: how do you recognize a phishing message?
Want to see how an employee learns to spot phishing? Employee learning module.
To recognize a phishing message, check the sender's address, the link before clicking, and the pressure the message tries to create. In an organization, email impersonation scanner shows whether someone can impersonate you by email, and phishing test for businesses tests how employees actually respond.
* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.