Tuesday's Tip #71: Phishing - 4 Ways to Prevent Being Caught

Phishing!! 4 Ways to Prevent Being Caught

What is Phishing?

At this point you probably know what phishing is - but to clarify - it's when a fraudulent email is sent with the intent of tricking the recipient (spoofed) to provide personal or financial information. This information can be used in a variety of ways, hacking and stealing from a bank account, identity theft or ransomware, among other things.

A Few Status About Phishing?

If you're wondering why it's important for you and/or your company to learn about phishing. Some interesting statistics from CSO Online.

• 94 percent of malware is delivered by email.
• Phishing attacks account for more than 80% of reported security incidents.
• Data breaches cost enterprises an average of $3.92 million.

4 Ways to Prevent Phishing Attacks

Although this is not an exhaustive list - these are the top ways to prevent phishing attacks.

1. Don't Trust the Display Name.
   The display name on an email is one of the easiest ways phishing attacks fool people. When you receive an email, rather than assuming it is from who it SAYS it's from - hover over the name to see the actual email address it was sent from.
   
   You can see in this example - it looks like the email is from "Orders".
   
   After opening the email or hovering over the "From" you can see the ACTUAL address.
   
   
   
2. Look for Spelling and Grammar Errors 
   This might seem trivial, but when phishing attacks are sent, sometimes spelling and grammar mistakes are intentional to avoid being caught by security software and filters other times it's written by someone not fluent in English. A careful look can prevent an attack. 
   
   Below is an example of a phishing email with spelling and grammar errors.
   
   
   
3. Don't Click to Login.
   
   Spoofing is when an email is sent out to look like a company you do business with, this could be a bank like Wells Fargo or the US Post Office. A spoof looks like it comes from one of these by using their logos and trying to trick you into clicking and logging on and providing your login/password so it can be stolen and then used on the actual site.
   
   Below is an example of a spoof for a US Post Office email.
   In this example, you will see multiple places to click to check for your delivery from USPS. If you look at the top - there is the actual USPS logo, so it's very deceiving. Further, you will see the FROM  address is not from a USPS email address.
   
   
4. Training. 
   Consistent and frequent training is also one of the best ways to keep your employees aware of the most up to date scams and emails to be on the lookout for. I have a 2 hour class I teach virtually for clients who want to get their employees up to speed and remind them of best practices. Additionally, if your organization would like to setup ongoing, targeted security training, I also provide resources to do this for your organization .I have multiple solutions for companies interested in internet security training. If you're interested - reach out and let's setup a time to chat. 
   
   If you're interested, email me and request my class outline.