One of the most common methods of cybercrime is phishing, where users are sent spam emails containing harmful content that could compromise their private data. According to Mimecast’s State of Email Security 2020, phishing attacks seem to have increased in the past half-year by 58%. Here is how you can carefully detect a phishing email attack according to It Governance.
An email sent from a public email domain
A legitimate organization would not send a professional email using their Gmail or yahoo accounts, they would use their corporate email domains. If the domain name is similar to that of the sender of the email, the message is probably legitimate and not a scam. You can double check by searching the company’s name on a search engine. However, cybercriminals can be very clever when trying to deceive people and may cover their tracks well. Some of them may use an inbox display name, to get users to open the emails like the displayed name would read Google or Paypal, even though the sender is using the spoofed organization’s name in the local part of the email address. Thus, checking email addresses and from where they have been sent is important in detecting if it’s legitimate or not, especially since some use official company logos and professionally write down emails to make them appear genuine.
The mis-spelling of the domain name
Domain names are pretty easy to purchase for anyone but cannot be replicated and need to be unique. However, some cyber criminals will create domain names that will be very similar to the organization that’s being spoofed. A slight mis-spelling in a domain name can easily be pulled off and not be detected by many users, since it’s indistinguishable from the organization being spoofed. This was experimented with by an ethical hacker, Daniel Boteanu, who sent emails from a fake domain that had one slight misspelling in the name, and easily phished people into clicking the link multiple times on different devices.
Poorly written emails
You need to pay attention to every detail of the message sent, which might contain poor grammar and spelling errors that would give it away. This is usually rare and such scams are usually manually operated. Scammers aren’t usually good at english and mostly belong to non-english-speaking backgrounds, so even if they use machine translators and grammar checks, the context will never be completely right. However, some people do commit typo errors when writing emails in a hurry, so recipients should be careful if they see an error, and consider the possibility of a typo if it hasn’t been repeated and if the adjacent key is closer.
Suspicious attachments and links
Phishing doesn’t only come through emails, but can come as scam text messages, phone calls and social media posts as well. Scam emails can include bogus links and attachments, capturing private sensitive information like credit cards, of users who follow the payloads. Infected attachments contain malware, irrerespective of what the message is about. Malware once released will infect the device and perform a number nefarious activities. Users should be careful when opening attachments, incase it may be infected, and heed pop-up warnings about the file’s legitimacy.
If the destination address doesnt match the content of the email, links should not be clicked. But some scammers hide destination addresses as well, so it may not be easy to spot a link that will infect your device and compromise your data.
Messages containing a sense of urgency
Mails requiring immediated attention to something important will always get the attention of the recipient, and hence, such emails are most successful in phishing. Such emails should be read carefully to check for signs that it might be illegitimate and a scam, before action is taken. These emails are also successful in workplaces, where they are sent by scammers disguised as their bosses at work.
To actively fight the threat of phishing, education towards the scam is vital and can help prevent people’s private sensitive data being compromised. Workplace training programmes or online eduaction courses on such matters can help users be more careful in being a victim to these scams.
