Phishing is a common method to obtain data, login information, even credit card details and remains one of the most persistent threats to cyber security.
This social engineering attack technique has been used heavily for many years while the sophisticated methods of such hacking techniques continue to evolve. Most commonly via email, phishing is a targeted attack where individuals or even groups seek to gain access or information while impersonating a legitimate individual or business.
What does a phishing email look like?
Phishing emails can vary in their sophistication but the most notable and therefore commonly successful attempts are designed to appear as if sent from a legitimate source. Most often, the email will create a sense of urgency and need to act playing on the recipients’ emotions.
Below is an example of what appears to be a legitimate email from PayPal needing attention.
(Source: phishing.org)
Though at a glance it may appear legitimate – correct branding, similar layout to typical automated emails from the company – there are small inconsistencies that will give away its true origins. This is to attempt to fool those receiving it to access what will likely also be a fake website also designed to look official and quite literally hand over all their information. All it takes is a moments lapse in concentration to be successful.
If you look closely, you will find a number of identifiers that will indicate this email is fraudulent.
- Sender email address – check the source address. This is usually the easiest indicator of an email’s authenticity. Some senders will also make attempts to defraud with a little creativity in the domain address so take the time to really look. When viewing via some email client systems, this can even be obvious without opening the email – this is the best way to avoid risk.
- Writing – when reading through the email, do you spot spelling errors or incorrectly written sentences, this is a clear sign of a problem. Correspondence especially from large organisations will be heavily checked so such errors would never happen.
Example of Microsoft Phishing email (source: phishing.org)
- Make a call – it is unusual for many organisations who are predominantly online and use automated systems to ask for you to call for assistance. This fraudulent Microsoft email is an example of this. Asking to contact a vague “800” number is out of character so should always be questioned. Unsure, you can also search the number online to check if legitimate – no records mean its likely false.
- Hyperlinks within copy – in this example it may appear the link will direct you to the same website it references but this may not be the actual case. Some email clients will allow you to hover or check the direct on the hyperlink before choosing to follow it. By clicking on what may appear to be a legitimate link, you may be redirected to a fraudulent website.
- Misshapen images – stretched, poorly aligned, or even pixelated images and button are another sign of questionable legitimacy. Premium brands especially major global or national names will use a range of professional online tools to delivery consistently designed communications. This approach also means consistency with brand, image, and overall look of anything they produce. If the look of the correspondence appears questionable, it probably is.
- Infected attachments – email attachments are easy to disguise as legitimate files, designed to exploit a lapse in concentration and common as may be a lower chance of detection by antivirus detection tools. .JS and .DOC files are the most common types of files use for this approach where they may be saved or through opening achieve direct access to hard drives. While less common .HTML files will direct most commonly to a fraudulent website and likely enable the sender to watch and access both the login credentials inputted on the fake website but watch for others too.
If it’s too good to be true, it probably is
It may seem obvious, but phishing is engineered to play on the compulsions of the recipient. This can be through emotional response by creating a sense of risk, fear or urgency, enticement through in demand items or broader situations such as global pandemic.
Temptation is another emotive tactic used by those seeking to defraud. During seasonal events or through other social engineered research, those seeking to defraud will target individuals with tempting offers, giveaways, or other similar emails under the guise of a legitimate brand or company in the same methods listed above, but all with the sole aim to gain access or information.
Typical methods are pretending to contact for a competition win, to receive a free item or service or similar in nature to gain a response. Further sophisticated methods generate targets following engagement with another source such as a malicious website or advert to track back to the user and gain their contact information to further exploit. Therefore, it’s not just the phishing email that can be the start of a pursuit to cause problems.
Stop and think
The best prevention is understanding and keeping aware. By keeping vigilant both to unexpected emails but also when receiving emails from contacts you already know, the risk is significantly reduced.
Remaining vigilant of emails from those who are already contacts is also necessary as a preventative measure as they may have been victim to a phishing email and then used as a starting point to spread the attack wider.
Though phishing is most common through email, as reported by the Office of National Statistics, phishing attempts have evolved to other areas of technology including text and phone calls. Over 60% of recipients of their most recent survey received at least one phishing attempt within the past 30 days. This trend is set to continue so awareness and vigilance is essential to stem the success of any attempts.
Read our latest news page for more IT security advice and tips to stay safe online.
Information Solutions offer a range of data security and IT support services to help keep your safe from threats. For details on how we can help you, speak to the team today.