Phishing is a social engineering technique that involves the purposeful and fraudulent manipulation of vulnerable individuals using false communication channels, usually via the internet. Phishing is done to persuade them to reveal sensitive information like login credentials, financial information, or personal information. Through the use of trust and urgency, this strategy takes use of psychological triggers and human behavior to trigger acts that jeopardize the targeted person’s security, frequently resulting in unauthorized access, data breaches, or financial loss.
EMAIL PHISHING
Email phishing is a deceitful tactic used by cybercriminals to trick individuals into revealing sensitive information, such as passwords, credit card numbers, or personal details, through the use of email. Imagine you get an email that looks like it’s from a trusted source, like your bank or a popular website. But, here’s the catch: the email isn’t really from them. It’s from a sneaky person trying to trick you. They might say something urgent or exciting, like you’ve won a prize or your account is in trouble. They want you to click on a link or give them your personal information, like passwords or credit card numbers. It’s like a pretend message to steal your important stuff. So, always be careful with emails, especially if they seem too good or too scary to be true!
How to protect yourself from email phishing
- Look at the Sender: Carefully look at the email sender. If it’s someone you don’t know or if the email address seems strange, be cautious.
- Check for Tricks: Before you click any links in emails, hover your mouse over them to see where they go. If it doesn’t match the website you know, don’t click!
- Think Before You Act: If the email looks suspicious, double-check with the company using a phone number you know is real.
- Watch for Urgency: If someone rushes you to open a door, they might be up to no good. Same with emails that say “urgent” or “act now!” Take your time and be careful.
- Trust Your Gut: If something feels off, trust your instincts. If an email seems fishy, it might be.
SPEAR PHISHING
In spear phishing, attackers personalize their messages to target a specific individual or organization. They gather information from social media and other sources to make their emails appear more convincing and relevant, increasing the likelihood of success, like in the case of the Bank of Bangladesh’s $1billion heist.
HOW TO PROTECT YOURSELF FROM SPEAR PHISHING
- Check Who’s Talking: If you get an email that seems like it’s from someone you know or talks about things you both know, be careful.
- Be Careful with Links: If someone offers you something, you’ll check it out, right? Links in emails are the same. Before you click a link, please hover your mouse over it to see where it goes. If it doesn’t look right, don’t click!
- Take Your Time: If someone rushes you, they might be up to no good. Emails that say “do it now” or “urgent” can be tricky. Don’t hurry; double-check before you do anything.
- Keep Secrets Secret: You don’t tell everyone your secrets, right? Don’t share those in emails unless you’re sure it’s safe.
- Watch Your Steps: Just like you look before you cross the street, watch carefully before you open any email. Don’t let fancy words or emergencies fool you.
- Report Anything Strange: If something doesn’t feel right, tell someone. Reporting can help others and stop bad people from trying again.
WHALING
Whaling is similar to spear phishing, but scammers target senior executives instead of employees. This is called “the big fish,” which is why whaling is used. This includes the CEO, CFO or any high-level executive with access to more sensitive data than lower-level employees. Often, many of these emails use a high-pressure situation to hook their victims, such as relaying a statement of the company being sued. This entices recipients to click the malicious link or attachment to learn more information.
HOW TO PROTECT YOURSELF WHALING
- Keep informed: Understand what whaling is and how it works. Whaling attacks aim to trick you into giving out sensitive information or transferring funds, frequently through impersonation or manipulation. Knowing the tactics helps you recognize suspicious behavior.
- Verify Requests: If you receive an email or communication asking for sensitive information or financial transactions, double-check its legitimacy. Contact the sender through a trusted means like a known phone number before taking any action.
- Scrutinize Email Addresses: Check the sender’s email address closely. Whalers might use similar-looking email addresses or domain names to deceive you. Look for small differences or inconsistencies.
- Double-Check Identity: When you receive requests for sensitive actions, independently verify the sender’s identity. Contact them using known contact information, not the information provided in the suspicious email.
- Use Multi-Factor Authentication (MFA): Enable MFA for your accounts, especially those related to financial transactions. This adds an extra layer of security, making it harder for attackers to gain unauthorized access.
- Educate Your Employees: If you’re part of a company, ensure that employees are aware of whaling threats. Conduct training sessions to help them recognize suspicious requests and know how to respond.
SMISHING (SMS Phishing)
Smishing also known as SMS phishing involves sending misleading text messages containing links or requests for a reply. These messages usually create a sense of urgency or present attractive offers, aiming to make recipients click on harmful links or share personal information.
HOW TO PROTECT YOURSELF FROM SMISHING
- Check the Message: Just like you check who’s at the door, see who sent the text. If it’s from someone you don’t know or looks strange, don’t attend to the message.
- Think Before You Click: If you get a text with a link, don’t rush to click it. Hover your finger over the link to see where it goes. If it seems off, don’t tap it.
- No Quick Replies: Sometimes, they want you to reply fast, like a game. But be smart. Take your time before you answer.
- Don’t Share Personal Stuff: Just like you don’t give your secrets to anyone, don’t share personal stuff like passwords or card numbers in texts.
- Stay Calm: If the text sounds super urgent or too good to be true, be cautious. Take a deep breath and think before you act.
VISHING (Voice Phishing)
Vishing—otherwise known as voice phishing—is similar to smishing in that a phone is used as the vehicle for an attack, but instead of exploiting victims via text message, it’s done with a phone call. A vishing call often relays an automated voice message from what is meant to seem like a legitimate institution, such as a bank or a government entity.
Cyberattackers make phone calls pretending to be genuine companies, like banks or technical support. They trick victims into sharing private information or doing things like giving away account details.
HOW TO PROTECT YOURSELF FROM VISHING ATTACKS
- Verify Caller Identity: Just like you’d double-check someone’s ID before opening the door, ask questions to confirm who’s calling. If they claim to be from a company, hang up and call that company directly using their official contact details to verify.
- Don’t Share Sensitive Info: Never give out personal details like passwords, credit card numbers, or social security numbers over the phone, unless you initiated the call and trust the person you’re talking to.
- Don’t Call Back Numbers Provided: If someone leaves a callback number, don’t use it directly. Look up the official contact information for the organization yourself to ensure you’re reaching the right place.
- Use Caller ID: Many phones display caller information. If you don’t recognize the number, let it go to voicemail. Legitimate callers will leave a message.
- Block Suspicious Numbers: If you get calls from unknown or suspicious numbers, block them. This can prevent future attempts from the same source.
The next best line of defense against all types of phishing attacks and cyberattacks in general is to make sure you’re equipped with the appropriate know and a reliable antivirus software. At the very least, take advantage of free antivirus software to better protect yourself from online criminals and keep your personal data secure.
