The Anti-Phishing Working Group (APWG), states that the term phishing “comes from the analogy that Internet scammers are using e-mail lures to ‘fish’ for passwords and financial data from the sea of Internet users” . Apparently, the “ph” was used as a tribute to the term “phone phreaking”, a technique used in the early days of hacking to take advantage of security weaknesses in the phone systems.
Phishing is defined as the use of “spoofed” (hoax) e-mails and fraudulent web sites for the purpose of fooling users into revealing personal data. Although e-mail is the primary channel for phishing attacks, some scams and scam companies are using instant messaging (IM), fake news bulletins, and social communities such as MySpace™ to fool users into divulging personal information.
The concept of phishing has actually been around for years. The term “phishing” was first used by hackers to describe stealing America Online® (AOL) accounts by acquiring usernames and passwords. With the ubiquitous spread of e-mail and internet access, the potential for criminals to take advantage of the technology has increased considerably in the last few years, with an almost exponential increase in incidents since 2003, according to many organizations that are trying to track this trend.
Flaws in e-mail protocols, security weaknesses in browser software, a basic lack of computer security education, and continuing susceptibility to social engineering attacks all contribute to the increase in incidents, as criminals are able to exploit these weaknesses to their advantage.