Digital transactions have surged significantly in the past few years, in fact, in 2023, a study by McKinsey found that for the first time, more than nine out of ten consumers had used some form of digital payment over the course of that year. This is a true reflection of consumers being open to new technologies which is on the one hand wholly positive, however, cybercriminals have also woken up to take full advantage of this trend.
Cybercriminals never stop thinking of ways to attempt phishing scams. Identity theft protection professional Carrie Kerskie stated in a recent interview that, "Bad guys are always finding new ways to get between you and your information and you and your money." When attackers get creative, we must stay alert and aware of the latest anti-phishing tactics. According to IBM’s Cost of a Data Breach Report 2023, it was the second most common cause of data breach in the US in 2023, and averaged $4.45 million in breach costs for companies. These numbers can be disastrous for any organization, no matter the size. If you want to protect against phishing attacks in 2025, the following list is a must-read.
Trending phishing scams to be aware of
Online impersonation scams: More commonly known as "Spoofing," this common cyber threat has evolved to include new platforms and sophisticated maneuvers. Cybercriminals imitate trusted organizations or individuals to trick users. to uncover information and gain access to company and personal assets. These lookalike domain attacks are a major threat, with over 30% of phishing emails leveraging this technique to gain trust.
Executive impersonation and whaling: Executive impersonation phishing is where cybercriminals impersonate the CEO or other high-ranking executives and use social engineering tactics to deceive employees. Whaling attacks are when the scammer targets an executive directly. The process is the same, the scammer poses as someone who is known to the CEO. In 2022, umbers showed that 59% of organizations say an executive has been the target of whaling attacks and 46% say executives have fallen victim. These sophisticated scams exploit high-ranking individuals to access sensitive company information and onvince victims to perform specific actions, such as wiring funds, providing sensitive information, or granting access to company systems. Any anti-phishing strategy must consider executives a particularly hot target and prioritize protecting them.
Social media ad scams: Social networks have been at the center of phishing scams for quite some time, but social media ads offer new opportunities for cybercriminals. Nearly a quarter of online shopping scams now originate from social media platforms, costing victims over $150 million in 2023 alone. s, Cybercriminals often use ads on platforms like Facebook and Instagram to lure unknowing consumers into their trap. . Cybercriminals make false promises that shoppers find hard to miss and gain access to personal information and accounts.
AI Generation Tools
As generative AI tools become increasingly used in both professional and personal workflows, they've also become a prime target for sophisticated phishing attacks. Cybercriminals are now creating convincing fake login pages for popular AI platforms like ChatGPT, DALL-E, and Midjourney, designed to steal user credentials and API access. These phishing sites imitate the design and user experience of legitimate platforms, often including identical logos, and near-perfect user interfaces. As AI becomes more critical in professional settings, these phishing attempts are likely to become more personalized, using generative AI itself to craft more convincing and targeted scam communications.
URL redirection scams: This tactic enables cybercriminals to exploit simple online mechanisms and redirect users from the original URL to a fraudulent one. It's hard for online users to detect this threat because we all encounter URL redirection on a regular basis, making it seem innocent enough. Scammers even go the extra mile and include CAPTCHA verification to make the interaction seem more authentic.
Some URL scams send users’ personal information to third parties. These scams might also trigger a “share” feature that forwards the malicious link to the person’s contact list, turning more unsuspecting users into phishing victims.
Other URL-based tactics present users with promotional deals, online contests, and other fake opportunities. These appear to be under the original website’s name and require users to provide personal information or payment details.
Messaging scams: Platforms like Facebook Messenger remain a common target for phishing, with attackers deploying strategies like fake update invites and deceptive login screens. Other Facebook Messenger scams approach users asking, "Is that you?" followed by a malicious link that victims are tempted to click. They are then directed to what seems like Facebook's login screen and unknowingly provide cybercriminals with sensitive information, including access to their contact list, which allows them the chance to deceive many others.
Staying Ahead in 2025
The landscape of phishing and scams evolves continuously, meaning businesses need to be more vigilant than ever. Using AI-powered digital platforms that offer robust and constant monitoring, detection, and takedown capabilities to combat phishing threats effectively will undoubtedly help organizations proactively defend their digital assets and customers at the same time.
Even if your organization takes pride in its external threat detection capabilities, staying alert is vital and being able to not only detect threats, but also defend against them makes all the difference. In the perpetual race between cybercriminals and protectors, you simply can’t afford to fall behind.
To learn more about ways to prevent these attacks, check out this blog - Phishing Attacks in 2025: What Businesses Need to Know
