How to recognize and report phishing attacks is one of the topics of this year’s Cybersecurity Awareness Month. And with over 90% of cyberattacks starting with a phishing email, phishing remains the most popular way for attackers to access your network and systems. While phishing is not new, technological advancements have made these types of attacks more sophisticated than ever. Read on to learn what you need to know about phishing, how to recognize an attack, and what to do about it.
What Is Phishing?
Phishing is a social engineering attack that targets users via communication that appears to come from a trusted source, such as someone they know or a trusted organization. The goal of a phishing attack is typically one or more of the following:
- Trick the user into visiting a fake website where their login credentials will be stolen.
- Trick the user into transferring money.
- Install malware onto a network or system.
Any information that is stolen during a phishing attack is most often either used by the attacker to gain access to network resources or to commit fraud or identity theft, or it is sold on the dark web.
Types of Phishing Attacks
While there are many different types of phishing attacks, the three most common all involve email. They are:
- Email phishing – Using email communication to convince the user to click on a link, provide login credentials, pay money, or click to download a file.
- Spear phishing – Email phishing sent to a specific person from an attacker who already has at least some of their personal information.
- Whaling – A subtle, highly targeted email attack sent to a senior executive, meaning the attacker is imitating another senior staff member.
It is common for a phishing email to use company lingo, including company names, employee names, and specific roles and titles within the company.
How to Identify a Phishing Email
Since email is the most common method used in a phishing attack, users must know how to identify a phishing email. This type of email typically has a few telltale signs, which can include any of the following:
- Different “From” and “Reply to” email addresses.
- A contact name, email address, or business you aren’t familiar with or have never done business with.
- A sense of urgency in the subject line and the body of the email that is written in all caps, use exclamation points, and provide a deadline.
- Poor grammar and spelling or awkward wording.
- Requests for confidential or personal information.
- Attachments the user is told to open that seem suspicious or are unexpected.
- A link that may appear as a legitimate website but doesn’t match the website displayed when you hover the mouse over the link.
Remember that all requests for information or clicking links or attachments are typically delivered with precise instructions.
What To Do If You Suspect a Phishing Email
Every staff member must be educated on recognizing a phishing email and what to do if they believe they’ve been sent one. If a phishing email or other type of phishing attack is suspected, it is crucial to never:
- Click on any links in the communication, even an unsubscribe link.
- Open attachments.
- Verify login credentials, such as usernames and passwords.
If you are uncertain about the origin of the email, they should:
- Contact the sender directly via phone, if possible, to confirm that they sent it.
- Use their browser to go to the organization in a suspicious link to confirm the information in the email.
If you can’t verify the email’s sender or it doesn’t feel right, it should be immediately reported to your cybersecurity team. Most email providers also have a way to write phishing or spam emails, usually by right-clicking on the email and following the prompts. You can then delete the message.
What If You Clicked on a Link or Attachment?
If you clicked on a link or attachment in a suspicious email, you should:
- Avoid providing any personal or confidential information.
- Disconnect from the network.
- Inform your cybersecurity team.
- Change all relevant passwords.
- Back up all relevant files and folders.
- Perform a scan of the device for malware and viruses.
Remember, it only takes one user to click on a link or attachment in a phishing email to launch an attack on your organization. Educate everyone who has access to your network, so they understand how to recognize a phishing email and how to report it. While there is never a 100% guarantee you’ll be safe, staying vigilant will ensure your company remains as safe as possible.
Contact Platinum Technologies today to learn how we can help you protect your company from phishing attacks.
