23 Jul Identifying and Understanding Phishing Emails

The dangers of phishing email scams

Phishing emails are among one of the oldest forms of cyber-attacks still employed today, often because they have a high success rate. The worst part is, phishing emails circumvent even the most advanced cybersecurity infrastructure. They do this by exploiting one critical thing: human error.

All it takes is a staff member clicking on the wrong link or submitting sensitive information to a malicious third party. That’s not a comforting idea, considering the cost of cybersecurity – so what can your enterprise do about it? The answer is both simple and complex: teach your staff how to identify phishing emails.

To help, we’ll give you a quick breakdown of common characteristics found in phishing emails, along with warning signs and things to watch out for.

Useful tips

It’s important to understand phishing emails all operate with the same intent: to steal private or personal information. Anything from login info to credit card numbers are up for grabs. So, as a first rule, an email or text you aren’t sure about will typically involve sensitive account data (and note there’s always emphasis on you needing to login to said account).

Phishing emails will also attempt to replicate messages from companies, friends, and even family. Long gone are the days of garbled text or obvious scam attempts (such as claiming the heritage of a wealthy relative). Instead, you might open your inbox to discover something that looks like an alert from PayPal, a forward from a close friend, a web-store account, and even your bank.

Hints

Here’s where things get tricky. Social engineering techniques use “official” content and media to deceive the reader. Generally, they try to alarm the recipient there’s an account problem and they need to login to rectify the issue – or click a link. Look for these common phishing characteristics:

• Including links to websites/logins
• Requesting you verify a password for a website.
• Contains a false invoice or alert that a charge was made on your behalf.
• Claims there’s a security problem with an account.
• Threatens to permanently lock an account.
• Claim you’ve won a contest or are eligible for free things.

These are only a handful of things observed in a phishing email but are common traits you can expect to see.

Phishing emails aren’t only text, however. Today, hackers deploy advanced methods to appear convincing. Media content is an important part of their success. Hackers use images, banners, and even disclaimers to simulate the appearance of an official email. What they expect is the reader to only glance at the content without focusing on the smaller details.

There are a few dead giveaways to indicate if an email/message is a phishing attempt:

• Spelling errors, no matter how small.
• Grammar errors and improper punctuation.
• Informal greetings and unusual sentence phrasing.
• Sudden changes in syntax and font color/font type.

Always practice scrutiny and air on the side of caution. We also recommended creating guidelines for identifying phishing emails, along with strict policies regarding how message content is handled for an organization. If you’d like to learn more or need third-party consulting, contact us at Bytagig.