Profiting off of other’s labor is nothing new. While the pandemic makes everyone’s lives harder, there are those who take advantage of moments like these. In times of crisis, phishing is one of the most popular types of cyber-attack, entailing to steal the vulnerable information of the target (could be anybody) through email, websites, physical mail, or phone call.
As we all know, it is easier to prevent a problem than fix one that is already there, so here is the rundown on Phishing attacks and how to avoid them.
What Is Phishing?
Phishing is the most common method of siphoning data from an individual or business, with the thief disguising themselves as a legitimate source. The idea that a password is all you need to protect your data, unfortunately, is false. The “business model” of phishing is to first gain the trust of a target, and then exploit them for personal data.
This personal data can include – your name, address, social security number, important credentials such as a username and password, bank account number, credit card details and so on. The biggest reasons people fall victim to these scams are lack of proper training, or just simple ignorance. Attackers can impersonate “trustworthy” organizations like banks, credit card companies, government agencies, social networking sites, and so on. All it takes is one click on a hyperlink in the message received, for you to enter your credentials, and your account becomes compromised.
Different types of Phishing Attacks
- Spear phishing – A targeted form of phishing where scammers get to know the target, focusing on winning their trust and confidence to eventually gain further access to personal information like financial details, credit card numbers etc.
- Smishing – Some phishing attacks use text messages. This approach is known as smishing because SMS is an acronym for the technology used to send texts. Meaning Short Message Service, like phishing emails, these texts may include links to deceptive websites.
- Vishing – also known as voice phishing, is the use of social engineering over the phone to collect personal and financial information from the target.
- CEO Phishing or Whaling – In this instance, the attacker pretends to be a high-level executive of the company and tells employees to provide confidential data. You are less likely to suspect anything because the message is from a trusted source.
- Scareware – Causes the victim to think their computer is infected with malware or has accidentally downloaded illicit content. The attacker then offers the victim a solution that in reality, will only cause further damage.
- Honey trap – A method used by the attacker in which they pretend to be an attractive person to create a relationship with the victim, and siphon information from them.
A Few Common Phishing Attack Tactics Include
Phishing attacks can also follow more conventional tactics.
Engaging offers – If a message asking for something seems strange or untrustworthy, it likely is. Always double-check the source.
The urgent activity required – This is to instill a sense of urgency on the target. The scammer may say that there is unidentified activity on your account – and you should sign in quickly to fix the issue. If you receive a message like this, be positive of its legitimacy before taking action.
Recent events – During seasonal holidays, pay extra attention to shopping deals or proposals, as this is a common means of attack by scammers.
Uncommon Senders: If you do not recognize the sender’s name, the message could be fake. Be cautious! It is easy for criminals to pretend to be from a trustworthy company.
Inaccurate beneficiaries: Phishing messages may not address you by name, instead of using more general terms like “Dear Customer”, or flat out use an incorrect name. Should this be the case, treat the message with extreme caution.
Attachments or links: Any messages containing attachments or links ought to be treated with doubt, particularly if the attachments or links in the message do not correlate with the original company’s web address. Crooks may camouflage harmful links with undetectable content that is almost impossible to identify.
Gift voucher tricks: We all love gifts especially if it is a surprise. Be careful! Always treat the random reception of gifts with suspicion. Gift voucher tricks happen every year, particularly around the holidays. The following are a few famous gift voucher tricks:
Supervisor trick: Imitation of a high-ranked individual in your organization, telling you to buy gift vouchers by giving them your card information.
Secret customer trick – Imitating a famous company, scammers may try to recruit you as a secret customer. They send you a check to buy gift vouchers, keep a segment as your “pay,” taking your credit information in the process. After you buy something, the check bounces.
IRS trick – Someone mimicking an IRS agent says your identity was stolen and asks you to confirm your personal information with them, inadvertently exposing yourself to the threat in the first place.
Technical support trick – In this one, the scammer sends an email to your PC or cell phone, after which claiming to be a technical support individual offering assistance.
The coronavirus has also caused an uptick in phishing scams.
Coronavirus testing, vaccine, and treatment tricks – Don’t put much stock in offers for early admittance to get the vaccine. Know that attackers are focusing on Medicare beneficiaries. They are offering fake COVID-19 testing dates to get individual data.
Coronavirus burial assistance trick – Attackers are even willing to go to the extent to pretend to be from FEMA’s COVID-19 Funeral Assistance Program, offering assistance to relatives of individuals who have died from the virus. Ultimately stealing social security numbers and other relevant information required for payment.
PS: Be sure not to photograph and post your vaccination card on social media, as it compromises the security of your personal information.
Charity tricks – Dubious charities are common in times of crisis. Only donate to well-known and trusted organizations
FDIC and banking – People claim to call from the Federal Deposit Insurance Corporation (FDIC), or your bank. They say your financial balance or ability to withdraw funds is at risk and request your individual data.
Grandparent and military service member tricks – Usually targeting older people, the scammer pretends to be a grandchild or a military service member, and then asks for a donation or money “to borrow”.
What Are the Risks of Phishing Attacks?
Apply for credit cards or services – Your individual data like date of birth, Social Security number, and address can be used to apply for credit cards in your name, can open utility records, or even attempt to get clinical consideration.
Drain your financial accounts – After getting access to your bank or credit card login, cyber attackers can easily transfer the money into their account own account or use your card numbers to purchase things for themselves.
Access your other accounts – People tend to insert the same username and password in multiple accounts. This makes it far easier for attackers to gain access.
Sell the data – Many attackers work for data farms. After obtaining your information, it could be sold to the highest bidder.
Regardless of their skill, a criminal always leaves a trace behind. Learn to look for these and prevent your data from landing into wrong hands.
1. The message is sent from a public email domain
No organization that sends an email has an address that ends with “@gmail.com”. The domain name is primarily located after the symbol “@” and just before “.com” (in most cases). The legitimacy of the message is shown by the corresponding domain name.
However, just checking the domain is not enough. These criminals have designed realistic websites to cover their tracks purely for instances like this. Always look at the email address carefully before moving on to clicking anything.
For example, the famous PayPal phishing scam. Despite it being very convincing, there was a clear flaw with the default email address ‘paypal@notice-access-273.com’. The fact that “PayPal” was not in the domain name proves its illegitimacy. Therefore, check and recheck the location of a domain name in an email address.
2. The domain name is misspelt
Apart from the location of the domain name, you can check its spelling. When an email is fake or a scam, in most cases the domain name is misspelled.
3. The email is poorly written
Aside from spelling mistakes, grammatical errors are also common. While creating phishing text, translation sites are often used which, while translating words properly, do not provide the accurate context, making the phrasing sound strange regardless.
4. It includes suspicious attachments or links
A phishing email or text message with misleading statements, and an attachment or link supplied. Be cautious and think twice before clicking on it.
Steps to Protect Yourself from Phishing
- Protect your data by backing it up – Back up your information and make sure those backups are not tied to your home network. You can transfer your PC documents to a hard drive or cloud storage, or back up the information on your mobile device, as well.
- Careful internet browsing – Companies succumb to phishing assaults mostly from reckless internet browsing. Establishing an approach that keeps employees more aware lowers a business’ possibility of having its security compromised.
- Antivirus protection – Antivirus protection is key to protecting your computer. It can scramble network traffic and secure your IP address, providing an extra layer of online security.
- Utilize many spam filters – A lot of potentially dangerous phishing emails, will go directly to your spam folder, so you never have to interact with them in the first place.
- Set unpredictable passwords and frequently change them – Keep passwords as fresh as possible. Make them hard to guess, and if possible, unrelated to you.
- Two-factor authentication – This is adding another layer to password protection, making it that much harder to get into your account.
- Set sound security policies – Have a standard ruleset to follow regarding email interaction with your employees. Staff should always know the next course of action when they receive a strange email.
- Security awareness training – Teach your associates to know the difference between real and fake emails. Perform phishing scams against your own staff to measure their ability to handle such a scenario. Additionally, test management to check whether they are sufficiently implementing these policies.
- Installing mobile security software – The BYOD unveils a new trend where certain mobile apps, having direct access to your employee’s address books, may eventually hamper your security. If this is the case, this intrusion by a third party should be stopped, potentially by installing mobile security software on employees’ phones.
On a Wi-Fi network, the chances of your data being stolen are astronomically higher. VPNs or Virtual Private Networks are a great means of protection as they merge mobile devices from services that offer secured DNS (Domain Name System) and blacklisting, thereby preventing access to phishing sites. - Double-check – If an email or message sent by a familiar sender seems irregular, immediately make a call to the person or the company to confirm your doubts.
How to recover and report phishing attacks?
- If you are exploited by a phishing trick, you should alarm the appropriate specialists.
- You can report a phishing attack to the Federal Trade Commission at its Complaint Assistant page.
- You can likewise report the assault to the Anti-Phishing Working Group or forward the phishing email at reportphishing@apwg.org.
- US-CERT works with the Anti-Phishing Working Group (APWG) to gather phishing email messages and sites to teach individuals what to look out for.
- On the off chance that you think someone has your data, similar to your Social Security, Visa, or financial balance number, go to IdentityTheft.gov. There you will find the particular steps to take dependent on the data that you lost. For example, for credit card-related phishing tricks, you can alarm the credit bureaus. For this, you have to visit the home pages of Experian Equifax TransUnion, the three public credit bureaus, and inform them about your current situation. You may want to freeze your credit to ensure safety.
- If you think that you have accidentally tapped on a link or attachment which automatically downloaded malware, update your PC’s security programming, and run a scan.
- In the event that you receive a phishing text message, report it to SPAM (7726). The data you give can help prevent further instances of scamming.
