Protecting against notification based phishing attacks

A system for protecting against notification based phishing attacks on a computing device, the system comprising:

• one or more processing units;
• and
• memory including computer program instructions that, when executed by the one or more processing units, cause the system to perform the steps of:
• when the computing device receives a notification appearing to be from a trusted application and requesting specified information, identifying a pattern for the notification and identifying an application that triggered the notification;
• determining if the identified pattern matches any of a defined group of pre-specified patterns, each of the pre-specified patterns being obtained from an associated specified application;
• when the identified pattern matches one of the pre-specified patterns, determining if the specified application associated with the matched pattern is the same as the application that triggered the notification;
• and
• when the specified application associated with the matched pattern is not the same as the application that triggered the notification, generating a message to alert a user of the computing device that the received notification may be a phishing attack.

A computer program product for protecting against notification based phishing attacks on a computing device, the computer program product comprising:

• a computer readable hardware storage medium having program instructions embodied therein, the program instructions executable by a computer to cause the computer to:
• when the computing device receives a notification appearing to be from a trusted application and requesting specified information, identify a pattern for the notification and identifying an application that triggered the notification;
• determine if the identified pattern matches any of a defined group of pre-specified patterns, each of the pre-specified patterns being obtained from an associated with a specified application;
• when the identified pattern matches one of the pre-specified patterns, determine if the specified application associated with the matched pattern is the same as the application that triggered the notification;
• and
• when the specified application associated with the matched pattern is not the same as the application that triggered the notification, generate a message to alert a user of the computing device that the received notification may be a phishing attack.