What is Phishing? Identifying and Protecting Your Business from Phishing Attacks

Spear Phishing
Spelling mistakes and poor grammar used to be the tell-tale sign of a phishing attempt. Over the years, phishing has evolved into a much more sophisticated cyber-crime as scammers began to use targeted phishing schemes. Spear phishing targets specific individuals and it’s often difficult to distinguish these emails from legitimate messages, which is part of the reason these cyber scams are so successful. Before the scammer sends you any communication, they already know some of your personal information. They’ve researched and learned about your business to pose as someone you do business with, or they’ve monitored your social media for tidbits about your life, i.e. did you post on social media about that big purchase you just made? Once armed with this information, they can craft a carefully worded message that will seem very believable to its targeted recipient.

Whaling
Whaling, or CEO Phishing, is another form of phishing that targets high-level executives and managers. The attackers, in this case, are looking to gain access to their target’s email account. Once they’ve gained access, their possibilities are limitless. They can access personnel files, initiate wire transfers, or gain access to any other information they’d like.

Ransomware Phishing
A ransomware phishing attack will typically be an email that appears to be coming from someone known to the recipient asking them to click on a link or open a file. Once the link is clicked or the file is opened, ransomware is loaded. The file may even appear to be legitimate – maybe it has the company logo – so the target may not realize what has happened until the attacker has locked all files and sent a ransom demand.

Vishing
Phishing is not just limited to email messages. Just as people use email and other technologies for criminal purposes, they’ve also found a way to use your VoIP phone systems to scam businesses and consumers by faking Caller ID. A typical vishing scam involves using VoIP with a modem to call phone numbers in a given area. When a person answers the phone, an automated recording states that the person’s credit card is showing fraudulent activity. The person is directed to call a specific toll-free or local phone number immediately. The number dialed may show a spoofed caller ID for the financial company the scammer is pretending to represent. When the call is made, the recording on the other line asks you to enter your credit card number and three-digit code, which is exactly what the scammers are after.

Smishing
Smishing is also done over the phone using text messaging. Scammers use text messages to try and trick people into giving them personal and financial information via text message by posing as a bank or credit card company. Often times there is a link to click on or a phone number they are asking you to call where they will try and obtain the information they are after.

1. Educate your employees. Implement security awareness training and teach your employees how to recognize phishing attacks.
   • If you spot a spelling error or poor grammar, it is very likely the message you received was not sent by the organization it claims to be from.
   • Think before you click. Before you download an attachment, always stop to evaluate whether it is from a legitimate sender. It is easy to make an email appear as if it came from your bank or other financial institutions. Check the actual email address of the sender to be sure they are whom they say they are.
   • If a call appears to be from a bank, credit card company, or other official business and requests financial information, end the call. Look up the official number of that business and call them back on that number. Never provide company credit card or other financial information over the phone unless you are already acquainted with the representative calling.
2. Filter your email. Most email security solutions include spam and virus filters. Anti-phishing protection solutions should check for domain spoofing and be able to flag questionable content.
3. Frequent backups. Because most phishing emails contain some sort of ransomware, it is important to keep your system consistently backed up. This will allow you to get employees back to work quickly by getting them access to the latest versions of their uninfected files.
4. Keep software up-to-date. Regularly updating your operating system and security software helps to fix security vulnerabilities being taken advantage of by hackers. A virus can spread across your network using gaps in security caused by out-of-date software.