Phishing is a type of social engineering attack used to steal user data, often using fake communications that appear to come from a trusted and reputable source but can compromise any data source. Such attacks can facilitate access to your online accounts and personal data, gain permissions to modify and compromise connected systems such as point-of-sale terminals and order processing systems, and in some cases can even hijack entire computer networks until a ransom fee is delivered, with devastating consequences. For individuals, this could include unauthorised purchases as well as theft of money or identity theft. Phishing is a common type of cyber attack that everyone should learn to protect themselves.
Phishing begins by composing messages that contain dangerous links, attachments, or lures designed to lure the intended victim, but whose actual target is to commit an unknowable, risky action. The message is made to appear as if it is from a reliable and reputable sender. It often uses emotions such as fear, curiosity, urgency, and greed to force recipients to open attachments or click links. If he deceives the victim, he is usually persuaded to provide confidential information on a scam website. Sometimes malware is also downloaded to the target’s computer.
Most Targeted Industries with Phishing
The main goal of scams is to earn money and therefore attackers tend to focus on specific sectors. The target can be the entire organization or individual users. The most targeted sectors are:
• Online stores (e-commerce).
• Social media.
• Banks and other financial institutions.
• Payment systems (merchant card processors).
• IT companies.
• Telecommunications companies.
• Delivery companies.
Most Imitated Brands
Attackers use well-known brands to fool as many people as possible. Well-known brands will instill confidence in buyers, which will increase the chances of success of the attack. Any common brand can be used for phishing, but a few common brands include:
· Microsoft
· Amazon
· Chase
· Wells Fargo
· Bank of America
· Apple
· FedEx
· DHL
Phishing Dangers
Personal Phishing Risks Include:
• Money stolen from your bank account
• Fraud charges on credit cards
• Loss of access to photos, videos and files
• Fake social media posts made on your accounts
• Cybercriminals who impersonate a friend or family member and put them at risk
Phishing Risks in the Workplace Include:
• Loss of corporate funds
• Disclosure of personal information of customers and colleagues
• Files crash and become inaccessible
• Damage to your company’s reputation
Tips for Detecting and Preventing Phishing Attacks
One of the best ways to protect yourself from becoming a victim of a phishing attack is to investigate phishing activities. Accordingly, there is a guide by the Federal Trade Commission (FTC) that shows the precautions to be taken in detecting a phishing attack and the way to be followed to report the attack to the appropriate places and reduce future data breaches. Possible signs of phishing attacks include:
• An email asks you to verify your personal information: If you receive an email that appears to be real but pops up out of the blue, that’s a strong sign that it’s an untrusted source.
• Bad grammar: Misspelled words, poor grammar, or a strange way of expression are sudden red flags of a phishing attempt.
• High-pressure messages: If a message seems designed to panic you and take immediate action, be careful—this is a common maneuver among cybercriminals.
• Suspicious links or attachments : If you receive an unexpected message asking you to open an unknown attachment, never do so unless you are completely sure that the sender is a legitimate person.
• Good to be true offers : If you are being contacted about a once-in-a-lifetime deal, it’s probably fake.
Things to do to prevent phishing attacks;
Although phishing starts with social engineering tactics, some new methodologies can be difficult to detect by users. Taking multiple steps to prevent malicious people from successfully infiltrating systems, networks, and software can reduce phishing risks.
• Monitoring their online accounts regularly
• Keeping the browser up to date
• Avoid clicking on e-mail links that come from untrusted sources.
• Be aware of pop-ups
• Never share personal information via e-mail
• Being wary of social and emotional temptations
• Keeping up with the latest phishing attacks
• Giving training to employees
• Using e-mail filters
• Installing website alerts in browsers
• Mitigate risks from malicious websites using access control lists (ALCs)
• Creating a robust and regular data backup program by following the 3-2-1 method of 3 copies of data in 2 different environments, 1 of which is off-site
• Installing security patch updates regularly
• PhishUp usage
