The Rise Of Phishing Schemes And Their Use Of HTTPS To Ensnare Unsuspecting Users

December 29, 2017

Rise Of Phishing Schemes

Phishing is nothing new. Most internet users nowadays have a firm grasp on what to look out for when it comes to Phishing 101. Dodgy spelling, no exact name, weird email address – just to name a few quirks.

Phishing has become more advanced. This has been confirmed by a recent report from PhishLabs, showing that more phishing schemes are adopting the use of HTTPS. Whilst most Phishing attempts are poor, there are many that are almost indistinguishable from the real thing, especially to less knowledgeable individuals.

What is Phishing?

Before we can explain the advanced techniques now being used in Phishing schemes, we must first explain what exactly Phishing is. Phishing is an individual or group trying to gain access to sensitive information, such as passwords and card details, by pretending to be a trusted entity.

The phishing process goes something like this:

  • Receive email from fake email address claiming to be a trusted organisation, usually stating something like an unauthorised purchase from your account has been made with a link to a website.
  • You click on this link and it looks somewhat like the trusted organisation.
  • It asks you to enter your username and password (sometimes credit card details depending on the Phishing scheme).
  • This information is then sent to the phishers and allows them to take control of your account

The most common disguises include banks, payment services such as PayPal, online stores such as Amazon, and gaming services such as or Steam.

Phishing is one of the most widely mentioned and educated against forms of online fraud. Governments and banks have taken it upon themselves to explain to users what to look out for and how to combat it.

Advancements in Phishing

One of the main things people look out for on the internet when entering sensitive information is the little green padlock. This indicates the connection is secured via HTTPS. It is thought that half of all websites are now encrypted with HTTPS.

The issue with this is that people let their guard down, and start to trust the green padlock just a little too much. This is partly due to education given to users stating that the green padlock means you have nothing to worry about.

This has prompted phishers to use HTTPS to their advantage. Using HTTPS means people drop their guard and they are more likely to trust the website. This is key for Phishing schemes as the key is to make the con attempt seem as legitimate as possible.

This works because phishing is essentially an electronic form of a confidence trick. You first must gain the trust of your target, the most efficient way to do this online is with the green padlock.

The Bittersweet Nature Of The Green Padlock

Whilst pretty much every security conscience individual would agree the proliferation of HTTPS across the internet is a good thing, it is a double-edged sword. On the plus side, most communications online are now encrypted, meaning that your bog-standard user is at least somewhat protected.

The major drawback is the trust that is put into that tiny green padlock. For those that are technologically educated, it isn’t such a big deal to filter out the cons from the legit communications. For those that are not so well acquainted with the ways of the internet, the green padlock opens a lot of issues.

It has been stated almost universally to always look out for the green padlock and HTTPS when entering login details and payment information. Most people will take this advice and run with it, meaning that any entity that has that padlock is seen as trustworthy. This even means people will overlook the other common signs.

People need to be rewired to not necessarily distrust the padlock, but to look at it with scrutiny and not use it as a single point of critique.

Related Articles

What we Learned from the US Border Image…

Facial recognition is a very controversial topic right now. When it’s been…

YouTube Accused of Violating Children’s Privacy

being questioned over it’s tracking methods and how overreaching they are. And…

Marketing Agency Exposes “Deeply Personal” Medical Records
