Phishing Scams
Phishing remains the most pervasive digital threat technique, using deceptive communications and lookalike websites to capture account credentials and sensitive identity records.
What is it?
Phishing is a form of social engineering where attackers mimic trusted organizations—such as technology companies, online stores, government agencies, or financial providers. Their objective is to convince you to enter your username, password, one-time verification passcode, or card numbers on a web page controlled by the attacker.
How it works
- Lure Delivery: You receive an unexpected email, SMS, or direct message claiming account suspension, password expiration, or unauthorized logins.
- Deceptive Link: The message contains a link to a website registered by the attacker that closely resembles the authentic login portal (often using typosquatting like
paypal-secure-login.top). - Credential Capture: When you enter your credentials on the fake form, they are recorded directly to the attacker’s server, while you are forwarded to the real website to avoid suspicion.
Warning signs
Claims your account will be suspended within 12 to 24 hours if you do not click immediately.
The link points to an obscure domain extension or subdomains unrelated to the brand.
Uses "Dear Customer" or "Valued Member" rather than your real name.
Requests that you disclose one-time SMS verification passcodes.
The $1.2 Million 'Mandatory Password Expiration' Trap
In late 2024, an accounting director at a municipal utility received an email seemingly from “IT Security Support” warning that her Microsoft 365 credentials would expire at 5:00 PM. Panicked during a busy audit, she clicked the link and entered her corporate username and password into what appeared to be an authentic single-sign-on screen.
The link pointed to login.microsoftonline-auth-verification.top, an adversary-in-the-middle reverse proxy that captured both the password and active 2FA session token in real time.
Within 72 hours, attackers inserted silent inbox forwarding rules, altered approved vendor banking details, and diverted $1.2M across three wire transfers before the breach was detected.
Example Communication
"Apple ID Notification: Your cloud storage has been locked due to billing failure. Verify your credentials at https://apple-account-resolution.top within 2 hours to avoid account termination."
What you should do
- Never log into an account via links received in unprompted emails or texts.
- Navigate to the organization’s official application or bookmark directly.
- Enable hardware-backed or authenticator-app Multi-Factor Authentication (MFA).
How ScamCheck Detects Phishing
ScamCheck evaluates the destination domain against official brand registries, inspects DNS age and high-risk TLDs, calculates Levenshtein distance for typosquatting, and checks global threat feeds—all without ever exposing your browser to malicious code.