Phishing, Smishing, & Vishing
Phishing, Smishing, & Vishing
Phishing
Phishing is a cybercrime in which a target or targets are contacted by email, telephone or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords.
The information is then used to access important accounts and can result in identity theft and financial loss.
Red Flags Commonly Found in Phishing Emails
From:
- I don’t recognize the sender’s email address as someone I ordinarily communicate with.
- This email is from someone outside my organization and its not related to my job responsibilities.
- The email was sent from someone inside the organization or from a customer, vendor, or partner and is very unusual or out of character.
- Is the sender’s email address from a suspicious domain (like micorsoft-support.com)?
- I don’t know the sender personally and they were not vouched for by someone I trust.
- I don’t have a busines relationship nor any past communictions with the sender.
- This is and unexprected or unusual email with an embedded hyperlink or an attachment from someone I haven’t communicated with recently.
Date:
- Did I recieve an email that I normally would get during regular business hours, but it was sent at an unusual time like 3 a.m?
To:
- I was cc’d on an email sent to one or more people, but I don’t personally know the other people it was sent to.
- I received an email that was also sent to an unusual mix of people. For instance, it might be sent to a random group of people at my organization whose last names start with the same letter, or a whole list of unrelated address.
Subject:
- Did I get an email with a subject line that is irrelevant or does not match the message content?
- Is the email message a reply to something I never sent or requested?
Hyperlinks:
- I hover my mouse over a hyperlink that’s displayed in the email message, but the link-to address is for a different website (This is a BIG red flag).
- I received an email that only has long hyperlinks with no futher information, and the rest of the email is completely blank.
- I received an email with a hyperlink that is a misspelling of a known website. For instance, www.bankofarnerica.com – the “m” is really two characters – “r” and “n.”
Attachments:
- The sender included an email attachment that I was not expecting or that makes no sense in relation to the email message (This sender doesn’t ordinarily send me this type of attachment).
- I see an attachment with a possibly dangerous file type. The only fire type that is always safe to click on is a .txt file.
Content:
- Is the sender asking me to click on a link or open an attachment to avoid a negative consequence or to gain something of value?
- Is the email out of the ordinary, or does it have bad grammar or spelling errors?
- Is the sender asking me to click a link or open up an attachment that seems odd or illogical?
- Do I have an uncomfotable gut feeling about the sender’s request to open and attachment or click a link?
- Is the email asking me to look at a compromising or embarrassing picture of myself or someone I know?
Five Ways to Avoid Phishing Scams
Think Before You Click!
It’s fine to click on links when you’re on trusted sites. Clicking on links that appear in random emails and instant messages, however, isn’t such a smart move. Hover over links that you are unsure of before clicking on them. Do they lead where they are supposed to lead? When in doubt, go directly to the source rather than clicking a potentially dangerous link.
Check Your Online Accounts Regularly
Even if you don’t technically need to, check in with each of your online accounts on a regular basis. Get into the habit of changing your passwords regularly too. To prevent bank phishing and credit card phishing scams, you should personally check your statements regularly. Get monthly statements for your financial accounts and check each and every entry carefully to ensure no fraudulent transactions have been made without your knowledge.
Keep Your Browser Up to Date
Security patches are released for popular browsers all the time. They are released in response to the security loopholes that phishers and other hackers inevitably discover and exploit. Chrome checks for new updates regularly, and when an update is available, Chrome applies it automatically when you close and reopen the browser.
Be Wary of Pop-Ups
Pop-up windows often masquerade as legitimate components of a website. All too often, though, they are phishing attempts. Many popular browsers allow you to block pop-ups; you can allow them on a case-by-case basis. If one manages to slip through the cracks, don’t click on the “cancel” button; such buttons often lead to phishing sites. Instead, click the small “x” in the upper corner of the window.
Never Give Out Personal Information
As a general rule, you should never share personal or financially sensitive information over the Internet. When in doubt, go visit the main website of the company in question, get their number and give them a call. Never send an email with sensitive information to anyone. Make it a habit to check the address of the website.
Smishing
Smishing is a cybercrime in which a target or targets are contacted by text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords.
The information is then used to access important accounts and can result in identity theft and financial loss.
Red Flags to Help Identify Smishing
Most smartphones store contact information, and authentic numbers use secure phone lines.
- Blocked, unknown, or incorrect caller IDs are all red flags.
- If you can't see the message sender, there is a good chance it's an attempted smishing attack.
- Be wary of phone calls from unexpected area codes or foreign countries.
- Random giveaway texts are clear warning signs of suspicious smishing activity. If there is any doubt, remember that if something seems too good to be true, it's probably a scam.
Do's and Don'ts
DO:
- Always double-check international area codes
- Beware of texts from unknown senders
- Update your phone’s software regularly
DON’T
- Answer or return calls from unknown numbers
- Click on any links
- Reply “STOP”
Vishing
A telephone-based form of social engineering where someone calls you directly and pretends to be from a legitimate company or service. Once on the line, they ask questions, try to get you to do something, or direct you to a website to obtain personal information, such as social security or financial account numbers.
How to identify a vishing scam
- Check the company.
- Call them back using a number you have on file.
- Watch out for requests for sensitive information.
- Be careful with websites.
- Protect your computer.
- Hang up.