The latest data from cybersecurity solutions provider Kaspersky showed that the Philippines recorded more than 4.5 million phishing attacks in 2022, ranking fifth in the Southeast Asian region.

Topping the list is Vietnam with a whopping 17.8 million phishing attacks, followed by Malaysia with 8.2 million, Thailand posting 6.2 million, and Indonesia completing the top list with 4.9 million.

“When it comes to scamming people online, phishing remains to be the tried and tested modus operandi of cybercriminals due to its cost-effectiveness and profitability,” said Adrian Hia, managing director for Asia Pacific at Kaspersky. “A malicious mail with a phishing link that leads to a phishing page lays the foundation for an attack that will eventually result in identity theft, financial loss, and damage to reputation for both individuals and businesses.”

Kaspersky: Scammers turn to Threads to spread phishing links
Kaspersky shows how scammers create fake pages using phishing kits

Most attacked sectors

According to Kaspersky, 27.38% of attempts its solutions have blocked globally are aimed at users of delivery services with scammers using the name of legitimate delivery companies to send phishing emails.

The second most attacked sector based on Kaspersky’s data is online stores comprising 15.56% of detected attempts and it is followed by payment systems and banks each comprise 10.39% of detected attacks.

In 2022, more than 43 million phishing attempts that targeted the devices of Kaspersky’s individual and enterprise users in the region were prevented by Kaspersky’s Anti-Phishing system to follow phishing links.

In Kaspersky’s previous studies, the average cost of data breaches for small and medium businesses (SMBs) from 2017-2021 is at $104,400 (or P5.8 million in today’s forex). The highest recorded financial impact was $120,000 in 2018 which went down to $108,000 and $101,000 in 2019 and 2020, respectively, during the pandemic. It has gone up slightly to $105,000 in 2021. 

“Recently, we’ve seen an increase in targeted phishing attacks where scammers don’t immediately move on to the phishing attack itself, but only after several introductory emails where there is active correspondence with the victim,” Hia said.