ICU6
ReportAlerts

Phishing

Fraudulent messages (email, SMS, calls, messengers) designed to steal credentials, data, or money.

What it is

A lure impersonating a trusted entity (bank, public service, shop, colleague) to push you to click, enter credentials/codes, or install software. Variants: email (phishing), SMS (smishing), phone call (vishing), messengers and social networks.

Vectors & goals

  • Cloned login pages to steal credentials (sometimes bypassing 2FA)
  • Attachments/“invoice–parcel” baits that deliver malware or macros
  • Consent phishing (OAuth): requesting seemingly legitimate access to your account
  • QRishing/QR codes, URL shorteners and open redirects

Common examples

  • SMS about delivery/unpaid fees, bogus fines, taxes to pay
  • “Account security” emails: password expired, suspicious login, urgent verification
  • WhatsApp/Instagram messages linking to a fake site or ghost shop
  • Targeted campaigns (spear-phishing/BEC) posing as a colleague/supplier
  • MFA fatigue: a burst of login prompts to make you approve
  • QR code on a poster/email leading to a credential-theft page (QRishing)

How to respond

  1. Do not click/reply; delete or archive as evidence. Verify via an official channel.
  2. Inspect the link: hover/long-press, unmask shorteners, spot homographs (rn/m, 0/O)
  3. If you clicked or entered data: change the password, enable 2FA, close sessions, revoke tokens/OAuth grants
  4. Forward an anonymised sample (with full headers for email) and report to ICU6
Report Learn more

Recognise, verify, and respond: the deep-dive

Anatomy of a phishing attack

Lure (promise/fear/urgency) → link/QR/attachment → cloned page or code prompt → credential theft → possible 2FA bypass (MFA fatigue, OTP social engineering) → account takeover → mail-forwarding rules/OAuth tokens for persistence.

Channels & variants

  • Email (classic, targeted “spear”, BEC)
  • SMS/MMS (smishing), WhatsApp/Telegram/Instagram messages
  • Phone calls (vishing), two-call scams with fake “banker/police”
  • QRishing, “mirror” payment pages, redirects and shorteners
  • Consent phishing (OAuth), counterfeit SSO login pages

Concrete red flags

  • Misleading sender address: irrelevant display name, different “Reply-To”
  • Links that don’t open the expected domain (homographs/punycode, rn↔m, 0↔O)
  • Urgency/threat/reward; requests for secrecy or immediate validation
  • Unexpected attachments (ZIP/ISO/Excel macro), QR codes in “security” emails
  • Requests for OTP/2FA codes or remote-control tools

Express verification (5 min)

  1. Preview the link (hover/long-press), unmask shorteners, spot homographs
  2. Open full email details: real sender, “Reply-To”, DKIM/SPF/DMARC if available
  3. Compare with the official site (type the URL yourself); check legal notice and contact
  4. Check whether the campaign is known (ICU6, CERT, bank alerts)
  5. When in doubt, don’t approve anything and report to ICU6

If you clicked / entered credentials

  • Immediately change the password of the targeted account and any account reusing it
  • Enable 2FA, close active sessions, revoke OAuth tokens/devices
  • Monitor for unusual activity; for payments, call the bank using the official number
  • Scan the device if files were opened; remove any installed remote-access tool

Preserve & submit evidence

  • Emails with full headers (or .eml file), screenshots with date/time, raw links
  • Calling numbers, full SMS content, short codes, URLs/QR, attachments (without opening)
  • Remove your personal information before submitting it to ICU6. The received content remains private; a limited card may be published with your permission.
Report Learn more