Phishing Explained

What is Phishing?

From a legal, regulatory, and corporate governance perspective, phishing is a foundational electronic fraud mechanism that compromises data security, facilitates identity theft, and disrupts market integrity. Phishing attacks exploit human psychology rather than system vulnerabilities alone, leveraging urgency, fear, or fake authority to manipulate recipients into performing unauthorized actions.

Federal and international regulatory bodies maintain strict oversight regarding both the perpetrators of phishing and the organizations obligated to defend against it:

• Federal Trade Commission (FTC): Prosecutes deceptive commercial practices under Section 5 of the FTC Act, enforces the GLBA Safeguards Rule, and mandates that financial entities deploy Red Flags Rule programs to detect social engineering and credential abuse.

• Securities and Exchange Commission (SEC): Enforces cybersecurity rules requiring public entities and investment firms to maintain robust internal controls against phishing-driven Business Email Compromise (BEC) and promptly disclose material cybersecurity incidents.

• Federal Financial Institutions Examination Council (FFIEC): Issues mandatory authentication and access guidance (e.g., phishing-resistant Multi-Factor Authentication) for regulated financial institutions.

• Federal Bureau of Investigation (FBI) & Internet Crime Complaint Center (IC3): Tracks, investigates, and coordinates interagency enforcement against global phishing networks and BEC syndicates.

How Fraud Manifests

Phishing operates across several distinct communication channels and methodologies:

• Email Phishing & Spear Phishing: Sending deceptive emails—ranging from broad mass mailings to highly targeted “spear phishing” messages tailored to specific corporate executives (whaling)—designed to harvest account logins or trick staff into executing fraudulent wire transfers.

• Smishing (SMS) & Vishing (Voice): Utilizing text messages or fraudulent phone calls (often using spoofed caller IDs) impersonating bank fraud departments or delivery services to trick targets into handing over one-time passcodes (OTPs) or personal information.

• Business Email Compromise (BEC): Impersonating CEOs, vendors, or legal counsel via hijacked or lookalike domains to instruct accounting personnel to process bogus invoices or alter wire routing details.

• Clone & Waterhole Phishing: Duplicating legitimate, previously delivered emails or compromising websites frequently visited by target organizations to insert malicious links or infected attachments.

• Adversary-in-the-Middle (AiTM) Phishing: Deploying proxy servers to sit between a target and a real website, capturing both credentials and live multi-factor authentication session cookies in real time.

Who is Impacted?

• Individual Consumers: Suffer account takeovers, stolen personal identity details (SSNs, banking credentials), tax fraud, and direct financial loss.

• Commercial Enterprises & Employers: Face catastrophic financial losses through fraudulent wire transfers, ransomware deployment via phishing attachments, intellectual property theft, and operational downtime.

• Impersonated Brands & Financial Institutions: Experience severe brand dilution, loss of customer trust, elevated fraud prevention overhead, and potential customer churn.

Regulatory Consequences for Involvement or Failure to Safeguard

Entities that orchestrate phishing operations—as well as regulated businesses that fail to implement mandatory anti-phishing safeguards—face stringent enforcement:

• Criminal Prosecution for Threat Actors: Perpetrators face prosecution under federal statutes including the Wire Fraud Act (18 U.S.C. § 1343), the Computer Fraud and Abuse Act (CFAA) (18 U.S.C. § 1030), the CAN-SPAM Act (for deceptive header/subject line violations), and Aggravated Identity Theft (18 U.S.C. § 1028A), which carries mandatory consecutive prison sentences.

• FTC & Regulatory Sanctions for Negligent Entities: Organizations that fail to implement reasonable security safeguards—such as phishing-resistant MFA, email authentication protocols (SPF, DKIM, DMARC), or employee training—face multi-million dollar civil money penalties, mandatory independent security audits, and strict 20-year consent orders.

• SEC Enforcement & Executive Liability: Regulated financial entities or public companies that fall victim to BEC scams due to inadequate internal accounting controls face SEC administrative proceedings, public enforcement actions, and mandatory financial penalties.

• Asset Seizure & Infrastructure Take-downs: Law enforcement agencies exercise statutory authority to seize domain names, server networks, bank accounts, and cryptocurrency wallets utilized by global phishing rings.