Phishing email warning

Phishing is a digital threat that tricks users into stealing personal data. Learn how to identify and protect yourself.

About this subject

Phishing is a cyberattack technique that uses fraudulent messages (emails, SMS, or links) to trick victims into revealing sensitive information like passwords, credit card numbers, and bank details. Globally, phishing remains one of the most prevalent threats: the Anti-Phishing Working Group (APWG) reported that the number of attacks doubled between 2020 and 2022, with the financial sector being the most targeted. In Brazil, according to PSafe, over 12 million phishing attempts were blocked monthly on mobile devices in 2023.

Attackers often impersonate legitimate institutions such as banks, tech companies, or government agencies. They use social engineering to create urgency: 'your account will be blocked' or 'click here to update your details.' Many phishing emails contain spelling errors or poorly copied logos, but sophisticated versions are nearly indistinguishable from the real ones. A notable Brazilian case involved 'fake kidnapping' emails mixing threats and phishing to extort money.

Effective prevention combines user training and security tools. Checking the sender, hovering over links to verify their actual destination, and enabling two-factor authentication are basic measures. Organizations like Brazil's Cert.br (Center for Studies, Response, and Incident Handling in Security) provide free guides. In 2024, the Brazilian LGPD (General Data Protection Law) increased organizational responsibility for preventing data leaks that enable targeted phishing attacks.

Interestingly, the term 'phishing' emerged in the 1990s as a variation of 'fishing,' because attackers 'fish' for naive data. With the rise of artificial intelligence, scams are increasingly personalized (spear phishing), demanding extra caution even from experienced users.

Frequently Asked Questions

How can I identify a phishing email?

Check the sender: suspicious addresses or domains different from the original. Beware of urgent messages, grammatical errors, and links that don't match the displayed text. Do not click on unexpected attachments.

What should I do if I fall for a phishing scam?

Immediately change the passwords of compromised accounts. Notify your bank or affected institution and monitor statements. File a police report online and report to phishing@cert.br (in Brazil) or the appropriate local authority.

Is phishing illegal in Brazil?

Yes, phishing can be classified as fraud (Article 171 of the Penal Code) and unauthorized computer device access (Law 12,737/2012, also known as the Carolina Dieckmann Law). Penalties range from 3 months to 5 years of imprisonment, depending on the damage.