Identifying and Dealing with Phishing

Phishing scams have the capability of taking down your online structures with the click of a button. From emails to texts, phishing scams can attack a business from any angle.

Being well-versed in these digital threats can help your business put up the defences needed to recognise and block this form of cyber-crime. Read on to educate yourself further on the dangers and types of phishing!

Pharming needs little cooperation from its victims. Instead of clicking on a link to a fraudulent website, the hacker installs a malicious code onto your server. This code then directs you to a dangerous website that’ll ask you to upload sensitive information (for example, they may pose as a trusted bank asking for your account details). Pharming has more potential harm than regular phishing, because there’s no active trigger for the attack from the side of the victim . This means there’s more of a chance for falling for the scam, because it’s harder to look for the tell-tale phishing signs (misspelled names, public domain email).

Avoiding pharming is quite simple . Using a specialised DNS system can add an extra layer of protection against scams such as phishing. It’s also a good idea to keep a keen eye out for any mistakes on the hacker’s part: misspellings in the URL/website, or the lack of a terms and conditions page is a giveaway to a thrown-together, scammy website. It’s also a good idea to enable two-factor authentication , as even if the hacker gets hold of your passwords, they won’t be able to use them without the code sent directly to you to access your accounts.

Whaling is when a hacker poses as a trusted, senior member of a company in order to extract information from a lower-level worker . This phishing scam is effective because employees are more reluctant to refuse information to those with authority over them in their workplace. They’re often able to gain legitimacy by choosing specific targets and researching them through social media before making contact. For example, if a person posts about visiting a local restaurant with colleagues over the weekend, the hacker might reference it in the phishing email. This builds legitimacy, and means there’s less suspicion on the victim's side when asked for personal details.

Aside from setting up s pam filters for employee emails, it’s important to ensure your workers are up to date on the latest prevention protocols. This means ensuring your workers know that you or any other senior members will ask for confidential details over phone, email, or in the same digital space. Just like with pharming, setting up two-factor authentication is also a good prevention in case personal passwords are leaked.

Regular phishing values quantity over quality: oftentimes, a generic email is sent out to thousands of addresses, with the hopes that a small percentage click on a malicious link. Spear phishing, however, is more specific than this.

With spear phishing, the hacker chooses a specific target and conducts research on them , (this may be done through looking through any social media or online profiles of the victim). They then use this information to craft an email that references knowledge they’ve gathered about the person (for example, they might reference a new season of a show the victim might’ve posted about). The email is then sent, with the hacker posing as a trusted source (maybe a family member or colleague). This then lures the individual into a false sense of security , and makes them more susceptible to clicking on any malicious links, or to giving over any confidential information.

Avoiding this type of phishing scam is mainly about ensuring you’re educated on how to respond to emails you’re unsure of. For example, if you receive an email from someone you know with a link/asking for private information, either call them or speak to them in person to confirm they’re the ones who sent the request. It’s also a good idea to check for the typical phishing signs on the email (the domain may have small differences from the real one, low-resolution images on the logo, and misspellings and mistakes are all signs).

This phishing scam is when the hacker uses multiple IP addresses through different domains to overwhelm a person’s spam filter. In simple terms, snowshoeing allows a hacker to cover a large amount of ground, so a small number of emails can make their way into a user’s direct inbox.

This is a difficult scam to avoid because the spam means that your email filters are less likely to catch malicious emails, meaning it’s more likely you’ll end up with malicious links in your direct inbox.

Adding too many spam filters may cause you to miss legitimate or important emails, meaning that more protection can often cause a different set of problems.

This is why educating your staff on the signs of snowshoeing phishing scams is important. Although different in execution, the appearance of these emails appears the same, meaning you’ll still be checking for the general signs (such as misspelled words, low quality images, etc.).

Phishing is a scam that affects many businesses and individuals. However, with the right information and training in place, we can prevent this cyber-crime. Vibrant provide phishing simulation attacks, security awareness training (SAT) and advanced spam filtering services. If you feel the need to update your digital security, feel free to reach out to the team at Vibrant, the experienced cyber security experts in Walsall. Call us now at 01922 612387, or email at info@vibrant-networks.co.uk.