A user receives an email about an unfamiliar bank transaction, which includes a link. When clicked, the link redirects the user to a web page that looks exactly like their bank’s website and asks them to log in with their username and password. Which type of attack is this?

The scenario describes a classic phishing attack. Phishing is a form of social engineering where an attacker uses a fraudulent electronic communication, typically email, to masquerade as a trustworthy entity. The goal is to deceive the recipient into revealing sensitive information, such as login credentials or financial details. In this case, the attacker uses a deceptive email about a bank transaction to lure the user to a spoofed website designed to harvest their username and password. This method aligns perfectly with the definition of phishing.

A. Whaling: This is a more specific form of phishing that exclusively targets high-profile individuals like executives or senior management.
B. Smishing: This attack is a variant of phishing that uses SMS (text messages) as the delivery vector, not email.
C. Vishing: This attack, also known as voice phishing, uses voice communication (e.g., phone calls) to conduct the social engineering attack.

1. National Institute of Standards and Technology (NIST). (2023). Glossary of Information Security Terms. NIST Computer Security Resource Center.

Phishing: "A technique for attempting to acquire sensitive information

such as bank account numbers

through a fraudulent solicitation in email or on a web site

in which the perpetrator masquerades as a legitimate business or reputable person."

Whaling: "A type of phishing that targets a specific high-ranking or high-profile individual in an organization."

Smishing: "A type of phishing that uses Short Message Service (SMS) to send the bait."

Vishing: "A type of phishing that uses voice and the public-switched telephone network (PSTN) to conduct the attack."

2. Cichonski

P.

Millar

T.

Grance

T.

& Scarfone

K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61

Rev. 2). National Institute of Standards and Technology.

Section 3.4

Incident Categories: Describes social engineering attacks

including phishing

as a primary incident vector where attackers deceive users into providing information. The scenario is a textbook example of the incidents this guide addresses.

3. Khonji

M.

Iraqi

Y.

& Jones

A. (2013). Phishing Detection: A Literature Survey. IEEE Communications Surveys & Tutorials

15(4)

2091-2121.

Section II-A

Phishing Definition: This peer-reviewed article defines phishing as "a fraudulent attempt

usually made through email

to steal personal information." It further distinguishes it from vishing and smishing based on the communication channel used. (DOI: https://doi.org/10.1109/SURV.2013.032213.00067)