Introduction
Phishing is one of the most dangerous types of cyberattacks given the dire consequences in the wake of a successful attack. In 2017, Google and Facebook had to bear a massive loss of $100 million because of phishing. These types of attacks are the most easy to fall for. It is imperative to be aware of the potential risks associated with them.
What is Phishing?
Phishing is a type of social engineering attack in which scammers trick people into disclosing sensitive information such as passwords and credit card details. It uses psychological manipulation to exploit people's weaknesses. It is one of the most common types of cyberattacks performed globally. Did you know that the average click rate for phishing emails in 2021 was 17.8%?
Some Common Phishing Methods
Scammers conduct phishing attacks in a wide variety of ways. Their techniques are also very sophisticated. Below, we discuss some common methods of phishing:
-
Email Phishing
Email phishing is the most common and effective method of phishing. Given its wide use, scammers target this communication channel the most. Phishers often use spoofed email addresses to make the email appear to be from a legitimate source. -
Fake Websites
Creating fake websites is another way used for phishing attacks. Attackers create replicas of existing websites. They design them in a way that it becomes almost impossible to discern the difference between the two websites, unless you pay close attention. This way, users unintentionally enter sensitive information on the counterfeit website. -
Smishing (SMS Phishing)
Smishing refers to phishing attacks attempted via text messages. Order Delivery Scams are one of the most common smishing attacks. -
Spear Phishing
Spear phishing is a category of phishing attacks that is aimed explicilty towards specific individuals or organizations. These phishing targets are not selected randomly. Phishers research their targets beforehand and may utilize their personal information in the attacks so that people are more likely to fall for the scam.
How Can You Identify a Phishing Email?
Identifying phishing emails can be difficult because phishers use sophisticated techniques to deceive users. With the boom of Generative AI, detecting phishing emails is becoming even more challenging. However, there are some commonly known tricks used by most phishers. Becoming aware of them can lower your chances of becoming a target to phishers.
-
Suspicious Sender
If you receive an email from a suspicious sender, check that it is not from a spoofed email address. A spoofed email address is a fake address that tries to mimic a legitimate organization. For example, you may receive a phishing email from a fake domain, "facebok.com," instead of "facebook.com." -
Mismatched Name and Email Address
Phishers take advantage of the fact that most people overlook a sender's email address and only read the sender's name, which can be easily set to any legitimate organization's name. For example, you may receive a phishing email from an account named "PayPal." However, the email address could be totally different, such as "[email protected]." -
Spelling and Grammatical Mistakes
One of the easiest ways to identify a phishing email is to look for any typos or grammatical mistakes, which can be both intentional and unintentional. One of the reasons for committing such errors is to target people who are likely to ignore them. -
Generic Greeting Style
An email with a generic greeting instead of a customized one with your name could be a phishing email. Phishers send out these emails randomly in bulk and do not know each recipient's name, so they opt for generic greetings such as "Dear user," "Hello sir/mam," or simply "Hi." However, Spear Phishing emails (where users are specifically targeted) may use personalized greetings to gain user's trust. -
Sense of Urgency or Threatening Language
Phishers use fear tactics so that people act hastily and ignore the fact that they are being lured into a phishing attack. Some examples are asking for credit card details while pretending to be a representative from your bank or asking you to reset your password within the next 10 minutes or else your account will be blocked.
Phishing Examples
- Account Verification Email
Asking to verify your account is a common tactic used by phishers. These emails look deceptively legitimate, tricking users into believing a legitimate platform is contacting them. Phishers coerce users to provide their sensitive information by saying that their accounts will be deactivated if they do not take action soon. Those who fall for the trap click on the malicious verification link and end up getting hacked.
Image: AppRiver
- Online Shopping Scam
Phishers create replicas of order confirmation and shipping emails from popular e-commerce platforms such as Amazon and eBay. As the email recipients haven't placed that order, they click on a link in the email to cancel that order, not knowing it is malicious. The link may take them to a website that is a copy of the original one and harvest users' sensitive information.
Image: IronScales
Precautionary Measures Against Phishing Emails
It is essential to be aware of the potential risks associated with phishing attacks and how to protect yourself from them before any damage is done. Following the best practices and using anti-phishing tools can make a big difference.
-
Enable Two-Factor Authentication (2FA)
Ensure that two-factor authentication is enabled on all your accounts to make it almost impossible for hackers to access your account. -
Install and Regularly Update Antivirus Software
Having robust antivirus software installed on your devices can protect you against many of the dangers posed by phishing attacks. Such software can detect and block potentially unsafe websites and email attachments. -
Raise Awareness
Conduct employee training to educate employees about the growing trend of phishing attacks and techniques for protecting themselves against bad actors. -
Use Anti-Spam tools
Use robust anti-spam and anti-phishing tools for automatically detecting phishing emails. -
Check the Destination of Attached Links
Do not open any links unless you are sure they are safe. Malicious links use misleading anchor texts. Hover over the links to check their destination. Copy the link URL (without opening it) by right-clicking on it and selecting "copy link address." Upload it to a link checker tool to ensure it is not being used for phishing.
What to Do if You Responded to a Phishing Email
If you accidentally interact with a phishing email by either replying to it or clicking on any link or attachments, don't panic and take prompt action.
-
Change your password and enable two-factor authentication (if applicable) on your compromised account so that the hacker cannot access it.
-
Report the email to your email service provider.
-
Contact the relevant authorities, such as your bank, if you accidentally provided your bank account information, card details, or account credentials.
-
Monitor your account and device for signs of any unusual activity.
How to Report Phishing Emails in Gmail
If you believe an email sent to you is a phishing attempt, you can report it to Gmail. Emails from an email address that is reported by a significant number of users will likely end up in spam. Gmail will mark the reported phishing email as spam and do the same for any similar emails in the future. A copy of the reported phishing email will automatically be sent to Gmail for review, which will be used to train its algorithms to detect such emails better next time.
- Open the phishing email.
Note: Be careful not to click on any links or attachments in the email.
-
Click on the three vertical dots menu to the right of the email.
-
Select the "Report phishing" option from the dropdown.
- Click "Report Phishing Message".
Block Sender Tool
Receiving phishing emails can be frustrating. Thankfully, most email providers can effectively block most of these emails and let you report any emails that manage to evade detection by their system. However, phishers may create multiple email addresses using a spoofed domain, such as [email protected], [email protected]. You may block one address but receive emails from other email addresses. You may be able to detect phishing one time but miss it the next. If you don't want this to happen, consider blocking the entire spoofed domain. You can achieve this by using Block Sender.
Block Sender is a robust tool designed to solve email-blocking problems. Need to block an entire domain, domain extension, IP address, sender, or email address, or bounce back emails? Block Sender lets you achieve all this using one app. You can install the browser extension or use the web dashboard.
Block Phishing Domains
-
Log in to the Block Sender web dashboard.
-
Select Blocks from the left-hand menu and click + New Blocking Rule.
-
Select Domain from the dropdown menu.
-
Enter the domain you wish to block, e.g., googl.com.
-
Decide where you want blocked emails to be sent, such as to the Trash, Delete, Archive, or Spam folder.
Note: Emails in the Delete folder are permanently deleted without being sent to the trash folder for 30 days.
- Select whether you want to bounce back all emails received from this domain.
- Click Create.
Setting up this domain-blocking rule will effectively block all future emails from this domain.
Conclusion
Knowing how to identify a phishing email is crucial for email users. Although phishing emails can be deceiving at first glance, you can tell if an email is legitimate or not by paying attention to a few subtle signs. Checking if a legitimate organization owns the domain name and not opening any suspicious attachments or links without verification play a substantial role in safeguarding your digital privacy.
