احتيال التصيّد

الأساليب الشائعة

• • Emails claiming your account has been compromised and urging immediate action
• • Fake login pages that look identical to real services like PayPal, Amazon, or your bank
• • Messages with urgent subject lines: "Your account will be suspended", "Unauthorized login detected"
• • Links that look legitimate but use lookalike domains (e.g., paypa1.com, amaz0n-support.com)
• • QR code phishing ("quishing") where malicious QR codes in emails or physical locations redirect to credential-harvesting sites
• • Browser-in-the-browser attacks that display a fake pop-up login window within a legitimate-looking page to steal credentials
• • AI-generated phishing emails with perfect grammar and personalized details scraped from social media profiles

كيفية التعرّف

• Check the sender's email address carefully — it often has subtle misspellings
• Hover over links before clicking — the actual URL may differ from the displayed text
• Look for generic greetings like "Dear Customer" instead of your actual name
• Watch for urgent language designed to make you act without thinking
• Inspect the URL in your browser's address bar for extra characters, misspellings, or unusual subdomains (e.g., login.paypal.com.attacker-site.net)
• Check for poor formatting: mismatched fonts, blurry logos, or inconsistent branding that differ from the real company's communications
• Be suspicious of emails asking you to download attachments you did not request, especially .html, .zip, or .exe files

كيف تحمي نفسك

• Never click links in unsolicited emails — go directly to the website by typing the URL
• Enable two-factor authentication (2FA) on all important accounts
• Use a password manager to avoid entering credentials on fake sites
• Check the website with ScamLens before entering any personal information
• Use hardware security keys (FIDO2/WebAuthn) for critical accounts, as they are immune to phishing since they verify the actual domain
• Keep your browser and operating system up to date — modern browsers include built-in phishing protection that blocks known malicious sites
• Report phishing attempts to the Anti-Phishing Working Group ([email protected]) and forward suspicious emails to the impersonated company

أمثلة واقعية