Phishing is a fraudulent attempt to obtain sensitive information by impersonating a trusted source through deceptive messaging. It has been a persistent threat to financial institutions for decades, but the nature of these attacks has changed dramatically. What once consisted of awkward emails with obvious grammatical errors has evolved into highly coordinated, multichannel schemes involving spoofed phone numbers and email addresses, impersonation of trusted people, and more effective social engineering. For financial institutions and their customers, this evolution significantly increases the danger of this threat.
Vishing, Smishing, Spear Phishing Phishing has evolved into several variations that use similar techniques: Vishing over the phone, voice email or VoIP (voice over Internet Protocol); Smishing through SMS (text) messages; Spear phishing that targets specific individuals or groups
The early days: Simple, single channel attacks
In the early years of email, phishing typically was easier to identify. Criminals relied on sending generic mass emails that often had poor grammar and used suspicious-looking email addresses. The malicious request often involved opening an attachment or clicking a link that would install malware or ask for personally identifiable information or account credentials.
Example of a Traditional “Old-School” Attempt:
Malicious email request with the subject line: Urgent Response Needed. The message reads: Dear customer your account is suspension. Download attached form and reply now to reactivate.
The modern threat: Multichannel, refined and personal
A visual graphic depicting a small icon of a sent email that expands to a spotlight depicting an ecosystem of channels across which criminals create believable and persistent fraud campaigns.
Most phishing campaigns now look nothing like these previous rudimentary attempts. Criminals may operate with the sophistication of professional organizations by blending technology, psychology and cross-channel coordination to create believable and persistent fraud attempts.
Characteristics of this modern threat may include:
- Emails, phone calls and text messages that appear to come from legitimate entities
- Spoofed phone numbers used to follow up with “verification” calls
- Text messages mimicking alerts or two-factor authentication requests
- Simultaneous social engineering to pressure victims into acting
- Ability to translate messages into most global languages
A flow chart depicting an example of a multichannel phishing attempt. Step 1 begins over email at 12:42 p.m. A customer receives an email from what appears to be their financial institution’s fraud department, asking them to ‘confirm unusual activity.’ Step 2 is at 12:42 p.m. over text. The customer receives a text from a spoofed number labeled as their financial institution’s short code, including a link to a website seemingly identical to the real one. Step 3 is a phone call at 12:50 p.m. The customer receives a follow-up phone call from a spoofed phone number that appears to be the financial institution. The representative mentions both the email and the text, creating both credibility and urgency. The final step occurs at 12:52 p.m. with an account takeover. The caller posing as the financial institution requests login details and verification codes ‘to secure the account.’ The criminal then logs in and initiates transactions while keeping the victim on the phone.
This multichannel approach can reduce the victim’s suspicions and drastically increase account takeover success rates. It also may bypass traditional controls, since communication is happening across multiple channels.
How financial institutions can protect themselves and their customers
These attempts typically succeed when criminals can impersonate an institution or other trusted entity, convince the victim and move money before detection. Effective mitigation requires proactive education and layered defenses across all three stages.
Prevent
Stop criminals from successfully impersonating the institution.
| Defenses | Channel | Why This Matters | Examples |
|---|---|---|---|
| Sender identity verification | Prevents criminals from sending emails that appear to come from the financial institution’s domain | Email authentication methods:
| |
| Caller identity verification | Phone | Reduces the effectiveness of caller ID spoofing used in impersonation scams | Stir/shaken: Secure telephone identity revisited and signature-based handling of asserted information using tokens |
| Brand and domain protection | Email/web | Identifies fraudulent domains or websites impersonating the financial institution early when large campaigns launch |
|
Verify
Help customers or employees confirm whether a communication is legitimate.
| Capability | Channel | Why This Matters | Examples |
|---|---|---|---|
| Customer scam awareness | All customer communication channels | Customers who recognize scam tactics may be less likely to engage with criminals |
|
| Secure customer communication channels | Online banking/mobile | Provides a trusted place for customers to verify message claiming to be from the financial institution |
|
| Out-of-band verification procedures | Phone/email | Confirms high-risk requests using a secondary, trusted communication method |
|
Disrupt
Stop or identify the fraud before money leaves the account.
| Capability | Channel | Why This Matters | Examples |
|---|---|---|---|
| Transaction verification controls | Digital banking/phone | Prevents criminals from completing high-risk payment requests | Dual authorization and payment confirmation |
| Suspicious activity monitoring | Digital banking | Detects unusual behavior associated with scams or account takeover | Behavioral monitoring tools (e.g., tools that establish a baseline for customers and identify irregular patterns) |
| Customer transaction alerts | SMS/email/app | Enables customers to quickly identify and report unauthorized activity | Real-time alerts and push notifications |
Phishing has progressed from simple scam attempts via email into coordinated, high-pressure, multichannel attempts that exploit trust, timing and technology. As criminals continue using advanced impersonation and spoofing tactics, defenses must grow equally dynamic.
Proactive education and layered defenses, such as multichannel verification and prompt response capabilities, are critical. By strengthening these areas, financial institutions can protect both themselves and their customers from increasingly complex phishing attempts.
