From a cybersecurity perspective, phishing emails are one of the biggest threats out there. It represents the most common form of cyberattack and happens to many people across the globe. In many cases, companies and people are told to “make sure your employees are trained to spot phishing emails.” Although this is good advice, a little more explanation is needed.
What Are Phishing Emails?
A phishing email is a fake email sent by a cyberattacker. It will normally be made to look like something legitimate, like an email from your bank or maybe even your employer. The purpose of this is to make you click on a boobytrapped link. Obviously, “boobytrapped” is not the technical term, but that’s how it works.
There are several ways in which this “trap” can be sprung. For one thing, they can embed a tracker in the link itself. This means that anyone who clicks on the link will have their IP address captured. The attacker can then look up the IP address on a site like this and find out all sorts of personal information. In cases of identity theft, this is particularly important.
Sometimes, a phishing email will not contain a malicious link, but will instead contain a deceptive link. These will redirect you to an official-looking website where you will be prompted to enter some kind of personal information. It might be a credit card number, usernames/passwords, or anything else the hacker wants. Once you enter that information, it is captured with a keylogger and used for malicious purposes.
A Few Examples Of Phishing Emails
If you want to learn how to recognize phishing emails, it would be very helpful to look at some known examples of such. We find this to be the best method of teaching you to recognize scam emails, so that is where we will concentrate our efforts. Let’s start with this article from Norton, which gives several good examples.
Example #1: The Two-Factor Identification Scam
The first one is an email that claims to be from Instagram. It tells the user that a suspicious login attempt was made on their account. Of course, it also prompts them to enter their login credentials to prove their identity. This fake is particularly well-done, but it can be spotted in a simple way. When you hover over the link and read its content, you see that it redirects to a website in the Congo. Since Instagram is not based in the Central African Republic, that’s a definite red flag. So, our first rule is: Don’t click on a link without checking it first.
Example #2: The Fake Job Offer
Let’s look at one that comes from another source. The Information Security Office at the University of California published this article, which contains more useful examples. Let’s look at the one labeled “Phishing Example: Congratulations! You’re Hired.”
This email is basically telling the recipient that they have been hired for a job, and that they will be able to begin work soon. This one is not as well-made as the first example, to say the least. The grammar is atrocious and the sales pitch is pretty transparent.
The most obvious red flag comes from this sentence: “You will also be making a Payment out to my Travel Agency as well for my return early next month.” That brings us to our next rule: Remember that legitimate job offers don’t ask you to pay them first. Another rule that is worth following: Be suspicious of messages that use poor grammar and spelling because official sources don’t generally make these kinds of mistakes.
Example #3: The Account Hold Scam
This example comes from the website of the Federal Trade Commission, which published this guide to recognizing phish attempts. This one pretends to be from Netflix and tells the recipient that their account is temporarily on hold because of a payment problem.
The email advises the user to login to their account and to update their payment details. It is a little more subtle because it doesn’t tell them that such action is mandatory: It just advises the victim that this is the best action to take. Obviously, the keylogger or screen capture program will be able to get their username, password, and all the details of their bank account.
So, how do we guard against this one? Well, that’s pretty easy. You can simply call Netflix and see if the account is actually on hold. If not, you know that the email is a scam. When you get an email urging you to update payment details, do not click the button or link. Instead, close out the email window and log in as you normally would, using official sites that you have used before.
Other Tips For Guarding Against Phishing Emails
It would be easy for us to keep studying examples all day. However, we don’t have that much time, and you probably don’t either. However, we urge you to study the examples we have provided and find others as well. Studying known phishing emails is the best way to teach yourself how to recognize these scams. Let’s go over some other general tips to remember:
- Be cautious with any email demanding immediate action on your part
- Look for any inconsistencies in web addresses
- If you must open an email attachment, do so in a sandbox environment
- Any email that requests personal information could be a scam
- Beware of offers that seem too good to be true
- Always double-check your emails with a phone call to the relevant organization
- Use browser add-ons that warn against malicious sites, trackers, and scripts
- If someone says you won a contest that you didn’t enter, it’s a scam
Conclusion
With a little common sense and diligence, it is fully possible to protect yourself against threats like these. Although they are very common, they can only work by relying on the ignorance of the victim. The more you know, the safer you will be. It really is as simple as that! If you have enjoyed this article and would like to learn more, please fill out the contact form.