HOW TO SPOT PHISHING AND PROTECT YOURSELF AGAINST THESE SCAMS?

Cybercriminals are using increasingly sophisticated methods to steal data and commit fraud. Yet it is often the simplest scams that turn out to be the most lucrative. One of the most common types of fraud is phishing attacks. A successful phishing attack on your business can subsequently lead to data breaches with all of their associated negative consequences.

Worryingly, although companies invest large sums in training and awareness programs for their teams. Unfortunately, we don't know how many of them tricked someone into clicking a link or sharing sensitive data. However, this is probably a very large part of the recipients.

Phishing or phishing: definition

Phishing is a type of scam that is most often categorized as cybercrime, as it often occurs through email, text, or social media. However, phishing can also take place over the phone, in person, or through automated calling systems.

Phishing involves cybercriminals impersonating legitimate companies or individuals in order to trick you into sharing sensitive data. Often, cybercriminals will search for your bank details or credit card details, or information such as passwords. It's important to note that phishing attacks don't necessarily need you to work. For example, simply opening a fraudulent email or text message may be enough to trigger malware that then retrieves the passwords saved in your web browser.

Once the crooks have retrieved the desired data, they use it for financial gain. Cybercriminals can sell the information to other malicious actors or they can try to use your personal data on their own to make purchases or transfer money from your bank.

The six most common phishing attacks

You and your coworkers should be aware of the most popular phishing attacks, listed below, that cybercriminals use, in order to better protect your business against them.

1. Phishing emails

Most phishing attacks happen through email. We will soon see how to recognize such scams. It is also worth knowing about specific targeted phishing techniques, such as those described below.

2. Spear phishing

Spear phishing is a targeted scam that often happens in two stages. After getting information about you, the crooks will come in contact with you in a malicious way. Sometimes using a direct threat, highlighting the information they previously gathered about you.

Spear phishing attacks are designed to scare you into sharing additional information with cybercriminals.

3. The whaling

Whaling is a specific phishing attack that targets employees in high hierarchical positions within a company.

This attack is often subtle and will be launched by cybercriminals masquerading as other people in managerial positions, such as accountants or lawyers, or even colleagues.

4. Smishing

This is the specific name given to phishing attacks launched by SMS.

5. Vishing

Vishing, or voice phishing, is the name given to phishing attacks launched by telephone.

6. Angler phishing

Angler phishing is a scam that typically sends malware through the direct messaging features of social platforms. Users of these networks may then receive fake URLs or be notified that they have been identified following a status update and when they click, the link downloads malware onto their device.

Have you ever received a strange “50 € discount in a supermarket” from a friend? If so, it's because he was most likely the victim of a phishing attack that allowed cybercriminals to send him to all of his friends and acquaintances.

 

How to spot a phishing email attack?

Have you ever received an email claiming to come from taxes, PayPal or Netflix but which obviously did not come from them?

It was actually a phishing attack!

Phishing attacks targeting work email addresses often come from a variety of sources. Most people don't use their work email for Netflix. Such a scam is therefore quite obvious and easy to spot.

While the “best” phishing attacks seem legitimate, which is why they are often so successful, there are many characteristics that most of them have that will help you recognize them.

Here's what you should look for:

1. At what time was the email sent?

Did you receive an email from a colleague in the same time zone as you at 1am? While many of us love the flexibility that telecommuting brings, if you usually don't receive emails from this person at such a time, it is likely a phishing attack. Solutions like UEBA help companies automatically detect this kind of unusual behavior.

2. What does the subject line contain?

Phishing attacks often use subject lines that look like responses to trick you into opening them. Look for subject lines such as "RE: Your last message". If you receive an email with such a subject line and you did not send an email to the person or company in question initially, delete it. Chances are, this is a phishing attack that will then attempt to install malware on your system as soon as you open the email in question.

Another common trick used by cybercriminals is the "clickbait" subject line, meaning that the content of the email has nothing to do with the actual subject mentioned in the first place. Use the preview features of your email software so that you can identify and delete them immediately if such emails arrive in your inbox.

3. Look for warning signs of malicious content

Phishing emails often use some or all of the following tactics:

·       A special offer you weren't expecting. Nevertheless, it is plausible that you will receive, for example, a refund offer for a specific product or service.

·       A gift too good to be true, like those emails in which someone's uncle died and left $ 30 million that he wants to share with you.

·       Calls to action (CTA) to questionable link.

Messages containing information about you to prompt you to take action. A phishing attack can often obtain commonly used passwords. A second will follow, making it clear that they know your passwords and require money.

4. Are any attachments present?

Attachments are often the most important business warning sign, especially when companies are working exclusively in the cloud.

If your company has a policy of using OneDrive or Dropbox, but a “coworker” physically sends attachments, it is likely a phishing attack.

However, if you are still working with attachments, beware of unusual file types or received files that you did not request.

5. Where will the hyperlinks take you?

Some phishing attacks manifest themselves by including long hyperlinks that you can click.

When a scam is more sophisticated and hides a link with a CTA button, you can still hover over the button to see where the link will take you.

Pay attention to:

·       Links that will take you to a different location than the one indicated in the email.

·       Links containing typos, often present to reinforce authenticity.

·       Emails containing links but without any other content or information.

If you click on a link, you will often be taken to a website that looks like a downgraded version of the real version. It's easy to create a webpage that looks like PayPal, but there will often be errors that indicate that this is not the real website.

6. Who else was the email sent to?

Phishing emails are often sent to thousands of people at once. Usually you can see the recipients in the CC area.

Look for emails in which you are copying a message / service that you have not requested or to which you have not subscribed and especially where you can see the email address of all the other recipients.

7. Where does the email come from?

The source of the email is often the first clue you can spot a phishing attack!

Look for emails that:

·       Come from an unusual email address, from someone you don't know or with whom you don't usually communicate.

·       Come from outside your company and have no connection with your function.

·       Appear to be from an internal email address but seem unusual or irrelevant.

·       Come from suspicious email addresses.

Remember to take a good look at the sender's email in the "From" box, not just relying on the information your email client displays about the sender. Some programs even allow scammers to set up legitimate email addresses, so you'll need to be doubly vigilant.

How to avoid phishing attacks and protect yourself against these scams?

Whether you are reading this article in a personal or business context, the ways to prevent phishing attacks and avoid falling victim to such scams are similar.

In addition to knowing what these scams look like, as detailed previously, make sure you have the following in place:

·       Spam filters, which will prevent most phishing attacks from reaching your inbox. However, cybercriminals are increasingly adept at circumventing these, so you need to be vigilant.

·       Up-to-date security and antivirus software for your devices or network. In a professional context, if your teams work remotely or use certain functions on their mobile devices, you must insist that they also have adequate protection.

·       Use tools like "Should I Answer?" And similar applications to identify potentially fraudulent incoming calls and SMS messages.

·       Configure multi-factor authentication on all accounts when possible. Even if the fraudsters collect access data, it will be very difficult for them to use it.

·       Limit access to sensitive data to a limited number of people within your company. The fewer people who can be targeted by cybercriminals for profit, the less likely you are to see one of them fall victim and affect your business.

·       Create backups of your data and make sure you store them independent of your main network, whether home or work.

·       Businesses should also ensure that specific policies, including prohibiting email attachments, are in place to reduce levels of risk, including using software to monitor all emails received from outside a business, such as email messages from freelancers or subcontractors.