Why HTTPS Isn’t a Guarantee of Safety: FBI’s Phishing Warning

The FBI recently warned internet users that a website using HTTPS is not necessarily safe.

Many people assume that a site with the lock icon in the browser address bar, indicating HTTPS encryption, guarantees protected traffic, but hackers have already begun exploiting this trust to conduct phishing attacks.

HTTPS adds SSL to HTTP, relying on certificates to verify server identity and encrypt communication between browser and server. However, attackers typically send emails that lure recipients to seemingly secure HTTPS sites, where they then steal sensitive data.

Users should not blindly trust the name of an email; they should examine the email’s intent and avoid clicking any suspicious links, even if they appear to come from known contacts, and instead verify through alternative channels.

Additionally, users should check the domain names of external links for anomalies, such as .com replacing .gov, and never become complacent just because a site uses HTTPS, as it may simply be a trick used by hackers.