Phishing accounts for 32% of all cyberattacks in 2025. This social engineering technique aims to steal your personal data by impersonating a trusted organisation. Here is how to recognise it and protect yourself.
Definition and methods of phishing
Phishing is a fraudulent technique that consists of posing as a trusted third party to obtain sensitive information: usernames, passwords, banking or personal data.
Cybercriminals mainly use three attack channels: fraudulent emails (90% of cases), malicious text messages (smishing) and deceptive phone calls (vishing). The goal is always the same: create a sense of urgency to push the victim to act without thinking.
The process usually follows this pattern: the victim receives an alarming message, is redirected to a fake site mimicking the original, enters their data, and the hackers then collect and illegally use this information.
The most imitated sectors are banks (35% of attacks), email services (Gmail, Outlook), e-commerce platforms (Amazon, PayPal) and social networks (Facebook, LinkedIn).
Recognising a phishing attempt
Always check the sender: fraudulent addresses often contain typos (amaozn.com instead of amazon.com) or use generic domains (@gmail.com for a bank).
Beware of artificial urgency: “Your account will be closed in 24 hours” or “Immediate action required” are classic phishing red flags.
Check links before clicking: hover over the link with your mouse to see the real destination. Short URLs (bit.ly, tinyurl) often hide malicious sites.
Look for mistakes: spelling errors, clumsy grammar and poor-quality logos usually give away amateur phishing attempts.
Effective protection against phishing
Never click suspicious links in your emails. Go directly to the official site by typing the URL into your browser or using your saved bookmarks.
Enable two-factor authentication on all your important accounts. Even if your credentials are compromised, this extra protection blocks unauthorised access.
Keep your browsers up to date: the latest versions include anti-phishing protections that automatically block known fraudulent sites.
Use a password manager: it will only fill in your credentials automatically on the real sites, alerting you to phishing attempts.
What to do if you are a victim
If you entered your data on a fraudulent site, change all your passwords immediately, contact your bank, monitor your accounts and report the incident (in France, on signal-spam.fr).
Leave a Reply