Phishing scams are one of the most popular tools in a cyber criminal’s arsenal today, given the ease with which they can deliver their attack through the relatively undefended route of email.
Email breaches come in a variety of forms, but predominantly involve the use of a false identity – creating trust between the recipient and the hacker – with the intent of duping the victim into unknowingly sharing sensitive information or opening a malicious file on their computer.
Deception is, of course, the key to a successful phishing attack – this trust is used to draw the victim into clicking on a link embedded within the email, which will often load a website posing as a brand entity or company likely known to the email recipient. The scammers go into extensive detail to impersonate individuals and entities that you or your team are likely to trust, so that you’ll comply with their requests. Familiar names such as Netflix, your bank or governmental departments will often be used – with a message requiring the user to act urgently in updating their credit card information or sharing their login credentials.
While most cyber criminals want to gain access to your systems or to compromising and sensitive information for financial gain, some do it for the pure goal of causing chaos.
Methods of the Phishing Scammer
There are technical solutions designed with the intention of blocking phishing attempts, but the most important and first line of defense is ‘the Human Firewall’. Your team needs to know what to look out for if a scammer slips through the net into their inbox.
Your team’s first reaction to any and every email they receive must be to distrust it, until they can verify its legitimacy.
Deceptive Phishing, as described above, not only impersonates an organization you trust, but it urges you to take immediate action. The email may contain a message along the lines of: “Click link to verify identity” or “Unverified account log in, click link to identify.” Or, it may seem to be helping you avoid something bad, when actually they are the bad thing to avoid. Messages such as these will often be accompanied by a redirect to a login portal designed to harvest account details.
Spear Phishing is a more targeted technique whereby the cybercriminal performs background research on the victim in order to pose as an individual or entity known to them personally. These criminals are not lazy – they will do whatever research they need before beginning an attack. Fraudsters can gather an extensive amount of information from social media profiles so you’ll believe it someone you know and trust. Scams of this nature have a higher chance of success as victims may not think they’d be targeted personally.
CEO Fraud is where the scammer impersonates a company CEO or other other high-status person. Armed with publicly-sourced information about the CEO they’re impersonating, they communicate with company employees asking them to perform tasks and transactions that would normally be unauthorized. The cyber criminals invent stories as to why the requests are valid in the hope that your team complies. Would you disobey and slow down the boss’s workday? You wouldn’t think twice if the source seemed genuine.
Cloning involves creating an identical copy of a previously sent email from a legitimate sender. This time, however, any of the links contained within the original email will be replaced with malicious ones.
Pharming involves directing users toward fake websites set up to steal login credentials and other forms of sensitive information. Cyber criminals may use viruses to direct individual users towards the rogue site – but this method does involve infecting the user’s computer beforehand, which can be difficult.
3 Ways to Avoid Phishing Attacks
With their techniques getting more sophisticated by the day, their manipulative talents, and their clever tricks, anyone can fall prey to Phishing scams. You must always proceed with care, examine links closely, and if you are in doubt, delete.
Pay close attention to URLs. If you find yourself redirected to a site from an email, take a moment to look at the URL to compare it to what you would expect. Look out for anything out of the ordinary, slight misspellings, extra words, or unnecessary hyphens in the domain name for example. Also look to see if the ‘top-level domain’ is as you expect. For example, if you expect ‘.com’ but you see ‘.fr’ then something is not quite right. As we said, if in doubt, just close your window and if you need to visit that site, enter the correct URL manually.
Know your bank and the way it operates. Do some research – or even contact – your bank to learn how they will contact you in the event of an emergency. Any financial establishment worth its weight will let you know exactly how they will get in touch so that you distinguish between legitimate communications and the fraudulent ones.
Do not reveal too much! A massive, publicly available social media presence is a goldmine to fraudsters, and they will use it to gain access to sensitive information. Apply privacy settings and keep things like your friends list, phone numbers and your date of birth viewable only to people you know and trust.
mPowered IT – Ensuring Cyber Security for Your Business
mPowered IT is your go-to proactive partner in keeping IT systems secure and defended. We never leave things to chance or wait for a problem to arise – predicting and preparing for the threats of tomorrow will help ensure your valuable data is protected and your business continuity maintained.