Phishing, a major cybersecurity challenge

The National Cybersecurity Institute (INCIBE) has counted more than 97,000 cybersecurity incidents in Spain in 2024, as it in its latest annual report, just published. Of these, 43.2 % fell into the category of online fraud (more than 38,000 incidents). Phishing leads this category with 21,751 cases.

This data is consistent with another recently published by the consumer organization OCU, which says that the queries and complaints they have handled for this criminal practice increased by 166% in 2024 compared to 2023. Data is important to know the context, but in this case personal experience works: who hasn’t received a suspicious email or SMS lately?

Phishing is a social engineering technique used by cybercriminals to obtain confidential information from users by deception. Through fake emails or SMS, they try to “fish” for sensitive data such as passwords, card numbers, CVV codes or access credentials by impersonating legitimate entities.

The aim of the criminals is to use the data to, for example, make transfers to their accounts without the consent of the account holders who, when they become aware of it, can no longer reverse the transactions. The financial sector is the most affected by this practice, but others, such as insurance, utilities and telecommunications, also suffer from it on a regular basis.

Apart from digital security, companies invest a lot of resources in outreach to warn their customers of the situation and recommend that they do not click on SMS or email links, even if they appear to come from the companies themselves. In these sectors:

• Contracts, policies or loans are signed through links sent by email or SMS.
• Notifications sometimes include downloadable documents, a situation that cybercriminals can exploit to hide malicious code.
• Communication processes often have a poorly recognizable image, with non-corporate senders or third-party links, which generates mistrust.

The most important thing companies can do to prevent their users from falling into phishing is to protect their channels, especially in cases of high-impact notifications. To do this, it is essential to design a strategy that brings together communication and digital security techniques and includes aspects such as:

• Implement processes that prevent, through technology, the success of phishing attempts. For example, through innovative, robust and secureelectronic signatures.
• Avoid launching critical processes (such as signing documents) directly from a link in a non-certified email or SMS.
• Encourage the use of official channels such as the corporate website, customer area or mobile app.
• Personalize and provide visual coherence (brand identity) to all messages, regardless of the channel.
• Use channels managed through a qualified trusted service provider: extreme guarantee of security.
• Generate secure and unique URLs, with random 32-character hashes that are impossible to predict.
• Incorporate verified channels, such as the use of verified WhatsApp.

One of the most important points of theanti-phishing strategy , as you have been able to read, is to use a trusted service provider qualified to manage digital channels, such as MailComms Group, in the form of certified electronic delivery. In addition, we are experts in personalized omnichannel communication and, something very important in the fight against phishing, in the implementation of electronic signature processes specifically designed to placate this criminal practice.

Our platforms guarantee the security of the data of the companies we work with and the privacy of their communications. Thus, we develop secure communication processes with clients who:

• They prevent phishing by using verified channels such as certified WhatsApp.
• They promote the use of multichannel and automatic channel switching based on receiver behavior.
• Leverage secure customer service platforms, possibly already available in each organization.
• Protect your key processes (signature, notifications, document delivery) with state-of-the-art technology.
• They employ digital security best practices and the latest trends, known and developed in powerful cybersecurity alliances.