phishing

Fraudulent emails (phishing) can come in different ways. Someone masquerades as an email address, sender’s name, phone number, or website URL (usually just by changing a letter, symbol, or number) to make you believe that you are interacting with a trusted source.

For example, you may receive an email that looks like it is from your boss, the company you do business with, or even your family, but it is not.

Criminals expect to be able to manipulate you into believing that these deceptive communications are true, which may lead you to download malware, send money or disclose personal, financial or other sensitive information. This is called spoofing.

What are Phishing Emails?

Phishing emails are emails sent as social engineering attacks and are usually used to steal user data, including login credentials and credit card numbers. This happens when an attacker pretends to be a trusted entity and tricks the victim into opening an email, instant message, or text message.

Phishing schemes often use deception techniques to lure you into the bait. These scams are designed to trick you into providing criminals with the information they shouldn’t have.

In a phishing scam, you may receive an email that appears to be from a legitimate business and ask you to update or verify your personal information by replying to the email or visiting a website. The URL may be similar to the URL you have used before. This email may be sufficient for you to take the requested action.

However, once you click on the link, you will be sent to a deceptive website that looks almost the same as the real website (such as your bank or credit card website) and asks you to enter sensitive information such as passwords, credit card numbers, bank PIN code, etc. These fake websites are only used to steal your information.

Statistics of Phishing Attacks

According to FBI data, phishing is the most common type of cybercrime in 2020. The frequency of phishing incidents has almost doubled, from 114,702 in 2019 to 241,324 in 2020.

The FBI stated that the number of phishing complaints in 2020 is more than 11 times that of 2016.

According to Verizon’s 2021 Data Breach Investigation Report (DBIR), phishing was the most common “type of behaviour” in data breaches last year, and 43% of breaches involved phishing and/or excuses.

The frequency of attacks varies by industry. However, 75% of organizations worldwide experienced some kind of phishing attack in 2020. Another 35% experienced spear phishing and 65% faced BEC attacks.

However, there is a difference between an attempt and a successful attack. 74% of organizations in the United States have experienced successful phishing attacks. This is 30% higher than the global average and 14% higher than last year.

ESET’s threat report shows that malicious email detection increased by 9% between the second and third quarters of 2020. Since then, there has been an increase of 9% from the first quarter to the second quarter of 2020.

Also read: How to Avoid Getting Scammed When Shopping Online

7 Ways to Identify Fraudulent Emails

1.Legitimate companies will not request your sensitive information via email

If you receive an unsolicited email from an organization that provides a link or attachment and asks you to provide sensitive information, then this is a scam. Most companies will not send you emails asking you to provide your password, credit card information, credit score or tax number, nor will they send you a link to log in.

Have you noticed the general name at the beginning and the unsolicited weblink attachment?
2. Legitimate companies will usually call you by your first name

Phishing emails usually use generic names, such as “dear distinguished member”, “dear account holder” or “dear customer”. If you are dealing with a company that requires information about your account, the email will call you by name and may instruct you to contact them by phone.

However, some hackers simply avoid the title altogether. This is especially common in advertising. The following phishing email is a good example. Everything inside is almost perfect. So, how do you consider it as potential malware?

 

This is a very convincing email. For me, the clue was in the email domain. More on that below
3. Legitimate companies has a domain name email

Don’t just check the name of the person who sent you the email. Hover your mouse over the “From” address and check their email address. Make sure that no changes (such as additional numbers or letters) have been made. See the difference between these two email addresses as an example of changing email: michelle@paypal.com michelle@paypal23.com Remember, this is not a foolproof method. Sometimes companies use unique or different domains to send emails, while some smaller companies use third-party email providers.

“Costco’s” logo is just a bit off. This is what the Costco logo is supposed to look like.

4. Legal companies know how to spell

The easiest way to identify fraudulent emails may be grammatical errors. Emails from legitimate organizations should be well written. A little-known fact-there is actually a purpose behind bad grammar. Hackers are generally not stupid. They prey on uneducated people, believing that they are less careful and therefore easier to target.
In addition to the generic salutation, grammar gaffes are usually a good clue that something is wrong. “Please fill this form…” And notice the ‘17’ reference in the middle of the sentence.
5. Legitimate companies will not force you to visit their website

Sometimes, phishing emails are completely encoded as hyperlinks. Therefore, accidentally or deliberately clicking anywhere in the email will open a fake web page or download spam to your computer.

This whole email was a gigantic hyperlink, so if you click anywhere in the email, you would initiate a malicious attack.
6. Legitimate companies will not send unsolicited attachments

Unsolicited emails containing stinking attachments from hackers. Usually, real organizations will not randomly send you emails with attachments but will guide you to download documents or files on their own website.

Like the tips above, this method is not foolproof. Sometimes, the company that already has your email will send you information that may need to be downloaded, such as a white paper. In this case, please be aware of high-risk attachment file types, including .exe, .scr, and .zip. (If you have any questions, please contact the company directly using the contact information obtained from its actual website.)

Just remember, curiosity killed the cat.
7. A legitimate company link matches a legitimate URL

Just because a link says it will send you to a place does not mean it will go. Check the URL carefully. If the link in the text is different from the URL displayed when the cursor hovers over the link, you will be taken to a site you don’t want to visit. If the URL of the hyperlink does not look correct or does not match the context of the email, don’t trust it. Hover your mouse over the embedded link (no need to click!) and make sure the link starts with https:// to ensure extra security.

Although very convincing, the real Nokia wouldn’t be sending you a “Save your stuff” email from info@news.nokia.com

What can you do to Prevent Phishing Attacks?

What can individuals and organizations do to prevent them from becoming targets of phishing attacks?
Although you can’t stop hackers from sending phishing or spear-phishing emails, you can make sure that you (and your employees) are prepared when you receive an email.

You should start with training. Educate employees about the main characteristics of phishing emails and remind them to proceed with caution and check emails, attachments and links before taking any further action.

  • Check the sender’s email address and pay attention to whether you are impersonating a trusted brand or person (check our blog CEO Fraudulent Email Attack: How to Identify and Block Email Impersonating Executives for more information.)
  • Always check the legitimacy by hovering the mouse over the URL in the email before clicking
  • Beware of URL redirects and pay attention to subtle differences in website content
  • Genuine brands and professionals usually do not ask you to reply to reveal sensitive personal information. If you are prompted, please investigate directly and contact the brand or person instead of clicking reply.

However, humans should not be the last line of defence. This is why organizations need to invest in technology and other solutions to prevent successful phishing attacks.