In this interview, Rohyt Belani, CEO at PhishMe, illustrates the magnitude of the phishing threat. He discusses techniques, consequences and protection tips.

What happens once your identity gets stolen? How exactly does a phisher benefit from gaining access to your sensitive information? What can he do?

Of course it depends on the information stolen, and the goal of the hacker, as to what can be done with sensitive information. The first thing to clarify is that there are two types of phishing attacks – consumer oriented phishing attacks and enterprise oriented phishing attacks.

In the case of an individual attack the end goal is to steal the person’s identity for financial gain – so to obtain credit cards and launder money through those channels; gain access to online identities – for example bank, PayPal and eBay accounts; make purchases that are easily converted into money such as train tickets and mobile phone top ups; etc. This type of cyber-crime is usually quickly detected, so the payload is limited, but it’s exceptionally difficult to identify the criminal behind the fraud leaving them free to practice their craft with little fear of capture.

More recently criminals have realised there’s more to gain from a corporate attack but with the same anonymity. If you think of a bank – every time a consumer falls victim to a phishing scam the losses are ring fenced to that one account. However, if just one employees’ workstation is compromised and the attackers gain a foothold on the inside of the corporate network then that’s a whole new ball game as theoretically that could expose every customer account and more.


A phisher needs just one person to click on a malicious link, or open an attachment laden with malware, to gain access to the organisation's network. From this vantage point there’s a multitude of possibilities – stealing R&D information, customer details, even hold the organisation to ransom.

One of the most important things is to be aware that emails are an attack vector and to treat all messages with caution – whether they’re from a stranger, a friend or a colleague.

What are some of the most clever phishing schemes you've encountered?

Phishing attacks can be categorised into three main forms – those with an authoritative tone, those that prey on greed, and those with an opportunistic message.