Phishing emails are a real problem for today’s businesses, which makes it critically important that you and your team can identify them as they come in. Phishing attacks are fake emails sent by cybercriminals designed to look like real, legitimate emails. There are a few reliable indicators that a message isn’t a legitimate one. Let’s discuss how to avoid the influence of a phishing scam.
What Makes Phishing Attacks So Bad?
One of the largest threats inherent in a phishing scam is that there is a relatively low barrier for entry. In truth, hacking has trended more towards the psychological, focusing on user manipulation over fancy programming skills. Which sounds easier to you, learning how to pick a lock, or asking someone for their keys?
Phishing attacks are not only easier on the cybercriminal, they’re also effective. It’s easy to be fooled by a legitimate-looking email or website, especially when you aren’t anticipating being scammed and when they give you concern that your personal information has already been compromised when it hasn’t.
While phishing emails themselves aren’t usually dangerous, they contain links to risky and insecure websites or have nefarious files attached to them. Generally, these elements are where the danger lies.
How to Spot and Avoid the Influence of a Phishing Attack
Let’s go through a step-by-step process to check any email that you may receive. Check all links to confirm they direct to a legitimate URL. DON’T CLICK THEM. For example, if the email were from Amazon, links would most likely lead back to amazon-dot-com. However, anything added between “amazon” and “dot-com” is a sign of trouble. Furthermore, the dot-com should be immediately followed by a forward slash (/). Never click something until you are sure that the source is reputable or familiar.
Let’s go through a few examples to demonstrate how important the little details of a URL can be, using PayPal as our subject.
- paypal.com – Safe
- paypal.com/activatecard – Safe
- business.paypal.com – Safe
- business.paypal.com/retail – Safe
- paypal.com.activatecard.net – Suspicious! (notice the dot after the domain name)
- paypal.com.activatecard.net/secure – Suspicious!
- paypal.com/activatecard/tinyurl.com/retail – Suspicious! Don’t trust dots after the domain!
Check how the email address appears in the header. If you ever receive an email from Google, the address isn’t going to be “gooogle@gmail-dot-com”. If you’re unsure, throw any email addresses into a quick search for legitimacy.
Be wary of any attachments. As we mentioned above, most email-borne threats are going to be transmitted as an infected attachment, or as a link to a malicious website. If an incoming email has either a link or an attachment, exercise caution. Don’t click them!
Don’t take password alerts at face value. Some scammers will use phishing emails to steal your credentials. Stating that your password has been stolen or some similar breach has occurred, the email will prompt you to supply your password—springing the trap.
Why You Need a Training Platform
Every organization is targeted. From the largest enterprises to the smallest mom-and-pop shops, if your organization saves data of any value, people will take it. That’s why it’s essential that you have a proactive mindset when training your staff for phishing.
Four Red Flags of Phishing
By our measure there are four key identifiers that you are dealing with a phishing message; and, these can be by way of any communication medium.
Let’s go through all four:
#1 – The Message Demands Immediate Action
A lot of messages we get are authoritative in nature, but when you get these messages, they typically don’t come from anyone that would typically need your attention. Basically, phishing messages usually read like someone urging you to act. That action is typically providing credentials, clicking on the in-text links, or opening an attachment; all of which are complete no-no’s.
#2 – There are Suspicious Errors in the Message
Many phishing messages try to give the sense that they are being directed to do something from someone of authority, In many cases, if the sender were legitimate, they would not only provide specific instructions that could be verified, but they also wouldn’t have any grammatical, spelling, or punctuation problems that many phishing attacks have. This is because oftentimes, the language that the scammers use in phishing attacks is not their first language.
#3 – The Addresses (or Senders) are All Wrong
If you were, for example, to get a message from your bank directing you to take immediate action, you most likely wouldn’t get it through email. Furthermore, the addresses that the email comes from don’t match the legitimate address that type of correspondence comes from.
#4 – The Feel of the Message is Suspicious
When the message you receive is suspicious, it’s likely to seem so immediately. Whether it is from a seemingly legitimate source and is written in a way that doesn’t seem right, or if it’s an instant message that shows up on your favorite IM platform with a sentence and a hyperlink; it’s not hard to determine whether something is a scam. You just have to be patient.
Get Comprehensive Phishing Training & Safeguards
With a healthy sense of skepticism, email and email correspondence can be very useful business tools. We hope this article has been of some help as to how to avoid the influence of a phishing scam. At Symmetric IT Group, we use emails every day like most businesses do. Many phishing attempts can also be weeded through with a reliable spam-blocker as well.
With phishing tactics being a big issue for every person that uses the Internet, you need to make sure to keep your head about you. If your organization needs help putting together a sustainable training strategy to ensure that your employees know what to look for, give us a call today at (813) 749-0895.
