Phishing continues to be a recurring threat to organizations, and most cybersecurity teams must implement regular corporate security training programs on phishing to keep employees alert and ready to combat these threats. The reality is, phishing works, and until it doesn’t, this cycle is bound to continue. Just this year, the TDRA issued an alert to the public over phishing links that were posing as major courier companies scamming people for financial gain or to steal their identities.
The news often covers when a company is hacked. There may be 42-second-long segments in the news about how many computers were encrypted and how much ransom was demanded, among other details. What is frequently overlooked is the follow-up, published six months or even a year after the hack is announced, and is typically relegated to IT security blogs because it simply is not exciting enough to make the big headlines. These will have a root-cause analysis, and the majority of the time, that root cause begins with a phish.
How to Identify Phishing
The primary goal of phishing scammers is to trick victims into disclosing personal information, which is frequently accomplished through phishing emails or text messages. Typically, these scammers will attempt to get hold of an individual’s passwords, national identity numbers, and account information. To maintain effectiveness, they frequently change the tactics they use to obtain this information and gain access to a person’s accounts.
With thousands of phishing attacks launched daily, it is difficult to keep up with the rapidly changing attack methodology, which makes it difficult to identify a phishing email or text message. The attacker may, very convincingly, disguise the email or text as originating from a trusted source such as a governmental institution, bank, or popular brand. Attackers often try to scare their prospects into taking immediate action by saying something is wrong with their accounts.
Common methods of infiltration include trying to access an account from a strange IP address, mentioning coupons or offers, saying they need to confirm personal information, claiming there’s an issue with payment methods, sending a false invoice, and asking for confirmation or payment via an included link.
Before taking action when an email asks for personal information or offers an invite to open an attachment, there are a few cues that individuals can look out for. First, ensure the “From” address makes sense and matches the organization sending the email. If the ‘From’ address seems different or new, it is best not to open attachments or follow any links.
Furthermore, individuals should be on the lookout for email addresses in the public domain (such as Gmail) when an organization sends them an email, as this is a significant red flag. Individuals can also keep an eye out for misspellings in domain names. Phishers often change just a couple of characters in a domain when sending an email to trick victims into thinking it’s legitimate when it is actually a scam.
The email may also be poorly written. Frequently, scammers are poor writers or send their emails to thousands of recipients in a hurry; therefore, read the email carefully and completely to comprehend what is being stated and how it is portrayed. Finally, be wary of emails with a strong sense of urgency. If the email demands that the recipient take immediate action to resolve a problem or face dire consequences, it is likely a scam. Scammers are aware that people have a tendency to procrastinate, so this tactic enables them to obtain results rapidly.
How to Report Phishing
Report any phishing email or text message received, following internal phishing reporting protocols. Once phishing has been recognized, it is crucial for the recipient to avoid responding or engaging with the message, and they should definitely not click any links, open any attachments, or take any action demanded by the attacker.
Once the phishing incident is reported, following the correct protocols, to the organization’s security team, the work is not quite done yet. Recipients should also report the phishing scam to their respective governmental authorities.
This helps contribute to the fight against fraud on a national scale. Finally, alert the organization or individual impersonated as part of the scheme. Reporting phishing emails is a multistep process that allows helping others to stay safe online. People are the last line of defense against phishing attacks, so before acting on a potential phishing scam, it is essential to remember to slow down, look carefully and thoroughly, and think clearly.
Source: Security Review