Phishing: what it is, how to spot it, and what to do if you are targeted by an impersonation attempt

In the digital age, almost all daily tasks are carried out by phone or via online channels: email, apps, websites, SMS, or messaging tools. Cybercriminals take advantage of any opportunity to steal personal data and use it fraudulently.

Direct, specialised attacks on company information systems are becoming increasingly frequent, as are individual attempts to manipulate customers and harvest personal information from the public digital world (internet and social networks). All with the sole purpose of obtaining personal data by impersonating a legitimate person or entity, such as your bank or energy supplier. This type of fraud is known as phishing.

According to the Global Anti-Scam Alliance, digital scams caused losses of more than €7.4 billion in Spain in 2024, and one in six citizens was targeted by at least one fraud attempt.

Daily tasks with electricity suppliers, such as checking bills, signing up for contracts, or updating personal details, also carry risks if data is misused. Therefore, it is vital that you stay alert to identify phishing attempts and avoid falling for them.

What is phishing? 

But when we talk about phishing specifically, what do we mean?

Phishing is a form of social engineering in which a cybercriminal or fraudster impersonates legitimate companies or institutions to persuade you to share sensitive information. There is a common pattern in this type of deception: exploiting your trust in a recognised person or entity by using personalised, friendly language, combined with a false sense of urgency or need.

The purpose of these fraudulent practices is to gain financial advantage or any undue advantage through the use or disclosure of sensitive or confidential information.

Most common forms of phishing

The term 'phishing' is over 30 years old, and the techniques used have evolved exponentially in the last three decades.

It is worth noting that the amount of money involved in cybercrime has been higher than the illegal drug trade for over five years. Cybercriminals dynamically adapt their tactics across different channels and media to target victims.

The most frequent phishing attacks use a mix of emails, SMS, and phone calls with friendly scripts and messages to manipulate customers—always with malicious intent. Credible stories, a friendly tone, highly personalised conversations, the use of technical data, pending bills, or contract updates are the most common hooks criminals use.

Email remains the most common channel. Attackers send a message that appears to come from a trusted entity with a subject line that generates alarm or urgency, such as a pending payment, a refund, or an account issue. The message usually includes a link redirecting to a fake page or an attachment that, when opened, installs malware on your device.

The evolution of cybercrime is directly linked to technological progress and the digitisation of society. In this context, artificial intelligence has made these attacks more sophisticated.

By accessing public information shared on social networks, cybercriminals generate highly personalised, realistic messages that are much harder to distinguish from the real thing. Furthermore, generative AI makes it increasingly easy to manipulate human emotions and behaviour.

Smishing (SMS phishing) is another widespread method. Here, an SMS arrives on your mobile with a link mimicking a company website. Its brevity and professional appearance increase the likelihood of you clicking the link.

Vishing (voice phishing) involves telephone fraud. The fraudster calls you directly and, using a convincing tone, requests personal or banking data, usually claiming they need to verify your identity, fix a system error, or threatening a penalty or service suspension.

Combining these channels (SMS, email, and phone) makes the story feel more real and increases the criminals' chances of success.

There are other specific types of phishing you should know about:

• Spear phishing

A targeted attack aimed at a specific individual or group within an organisation to gain access to sensitive information or compromise internal systems. These often look like emails from a colleague or manager requesting access to private documents or credentials.

• Whaling

 A variant of spear phishing targeting senior executives or decision-makers to steal financial information, authorise transfers, or access sensitive data (e.g., fake emails supposedly from the CEO requesting an urgent transfer).

• Clone phishing

 The attacker clones a legitimate email you previously received and resends it with a malicious link or attachment. The goal is to exploit your trust in the original message and trick you into giving away confidential information.

• Pharming

 A technical manipulation that redirects you from a legitimate website to a fake one without you noticing, in order to steal passwords, credentials, or banking data (e.g., typing your bank's URL but being redirected to a fake replica designed to steal your login details).

Telltale signs of phishing

There are common indicators that help you recognise an impersonation attempt before it is too late:

• Suspicious sender: If the email address does not match the official one exactly, or uses strange domains, be suspicious.
• Unknown numbers: Stay alert to unexpected calls or messages. Verify the sender's identity before sharing any personal or sensitive data. Corroborate information by contacting the provider through their official channels.
• Spelling mistakes or use of unnatural language often betray translated scam texts.
• Impersonal/generic greetings ('Dear customer') or incorrect information.
• Urgency or threats: Messages demanding immediate actions or using threats ('your account will be blocked if you do not act immediately', 'we will proceed to suspend the service') if you don't respond instantly.
• Suspicious links: Never click a link unless you are certain the communication comes from an action you requested.
• Unusual requests: Be wary of companies requesting passwords, card numbers, or personal data via email or SMS. Be wary of requests to install data verification apps on personal devices and always go to official channels to verify authenticity.

Examples of phishing using Endesa’s name

As the country's leading energy company, Endesa is a prime target for cybercriminals who try to use our reputation to trick victims. They have used orchestrated sophisticated phishing campaigns. For example, you might receive an email pretending to be from Endesa: