History and stories
Where “phishing” got its name
Phishing is named after fishing: cast a lure and see who bites. The odd spelling came from the hackers who coined it.
1 min readStory
The short version
The word comes from 1990s scammers who posed as online service staff to steal passwords, borrowing the spelling from phone phreaks.
The story
In the mid-1990s, millions of people went online through America Online (AOL). Scammers there sent instant messages and emails posing as AOL staff, asking members to “verify” their account by sending their password or billing details.
The people doing it called the practice “phishing”: fishing for passwords with a lure, spelled with “ph” in honor of the phone phreaks who had hacked the phone network a generation earlier. The word appears in an AOL discussion newsgroup in January 1996, and spread from there.
AOL started warning members that its staff would never ask for a password. That warning is still on nearly every service you use.
Why it mattered
Phishing grew from a nuisance on one online service into one of the most common ways attacks begin today. The basic trick has hardly changed: pose as the service someone trusts and ask them to confirm their details.
The lesson today
The core trick has not changed in thirty years: pretend to be someone the victim trusts, then ask for a password. What changed is the polish. A phishing page today can be a pixel-perfect copy of a Microsoft sign-in page, and the message can arrive from a real colleague’s account that was taken over first.
The rule from 1996 still applies: real support staff do not ask for your password, and no legitimate message needs you to sign in through the link it sent you.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.