Phishing is probably one of the most common and well-known attack methods today. Google is reportedly blocking 18 million coronavirus scam emails every day and registered a record 2 million phishing websites in 2020. Even though phishing attacks are constantly evolving, becoming technologically sophisticated and more prevalent, the following trio of basic laws apply at the heart of an attacker's strategy.

Imitate, Motivate and Act

Imitation is the impersonation of a trusted source. A phishing message will always strive to look like it originates from a trusted organization or individual. Most cybercriminals try hard to make their messages look legitimate and convincing, using the same fonts and copying colors, logos and branding to fool people.

Motivation is the social engineering part of the phishing attack. Scammers tailor messages for one single reason — to motivate people to take action such as a click, reply, download or tweet. They exploit human instincts by crafting phishing messages that get victims upset, curious, infuriated or anxious. Such messages play on a victim's emotions, provoking a response.