Don’t Be Fooled: Identifying and Avoiding the Latest Phishing Tactics

The Employee Phishing Checklist

1) How Phishing can affect the business you work for

There is no doubt that the amount of phishing attacks and related scams has continued to rise. (For more information on the rise of phishing, see our previous blog). You are probably aware of this yourself. Most of us have received deceptive emails and SMS that look like they are from a familiar company and may even have fallen for the bait.

Phishing attacks and identity theft can impact our own credit score and lead to feelings of anxiety and stress, so now is as good a time as any to make sure that you can spot a phishing attack. Not only is this useful from a personal perspective, but spotting phishing also help protect your business or the business you work for.

Here are just a few ways in which companies can be affected by phishing attacks:

• Breaches which use stolen credentials (obtained through phishing and fake websites) can bring the business down and disrupt operations, often leading to losses in sales. Once cybercriminals have access to your network through stolen passwords, they can install malware, for example, which can disrupt operations and online services.
• Access to customer information by cybercriminals mean that your business is not complying with data protection legislation, opening it up to potential fines, a damaged reputation and loss of customers.
• Ransomware requests and financial scams, such as sending fake invoices, can result in financial losses for the business.

All of these can impact your organisation and the bottom line. Cybercriminals play on human nature, targeting messages to individuals that have a sense of familiarity and urgency to gain access to systems and sensitive information. As an employee, you can play an important part in stopping these phishing attempts.

2) Types of phishing to look out for

There are more and more methods that are being used to trick us into providing our credentials, sensitive personal and company information or getting us to click on links which download malware. Let’s take a look at the different types of phishing to look out for, with examples for each.

Types of phishing through different communication methods

Phishing can be received via a range of different communications.

Email Phishing: Attackers will impersonate legitimate companies or individuals to deceive recipients – asking for personal information or asking the recipient to click on a malicious website link or download attachments.

Example: You receive an email from a bank informing you that your account has been compromised and requesting you to click on a link to verify your credentials. The link takes you to a fake website designed to steal login information.

Voice Phishing – Vishing: Phone calls or voice messages are used to trick victims into providing sensitive information or into transferring funds, for example.

Example: You receive a voice message from a bank that informs you that there has been some suspicious activity on your account and asks for you to verify your identity. When you reply via the number provided you are linked to the scammer’s phone number.

SMS Phishing – Smishing: Smishing is when phishing messages are sent via SMS/Text. Here attackers are also impersonating trusted companies asking recipients to click on a malicious link or provide personal information.

Example: You receive a text message from a delivery company saying that your package delivery failed and asking you to click on a link to reschedule delivery. The link is directed to a phishing website designed to steal your personal information.

QR Code Phishing – Quishing: While the risk of scanning a physical QR code in a public place, such as a restaurant, is relatively low, QR codes are increasingly being used in phishing emails. As people become more and more suspicious of odd-looking links or cautious about clicking on shortened links, criminals are starting to use QR codes to disguise malicious websites.

Example: You receive an email which contains a QR code and are asked to scan it. Exercise caution in the same way that you would for any link in an email and check to make sure the source of the email is legitimate.

Social Media Phishing: Social media platforms are also used to impersonate individuals and companies to send phishing messages and distribute malicious links to steal personal information and credentials.

Example: You receive a request to connect from well-known brand or seemingly legitimate person, but a scammer has created a fake social media profile. You accept the request and the scammer sends phishing messages or malicious links to your friends.

Phishing for financial gain

Ransomware: Ransomware attacks often begin with a phishing email that contains a malicious attachment or link. When the victim clicks on the link or attachment ransomware is installed on the victim’s system, encrypting files and asking for payment for their release.

Example: You receive an email with an attachment that is claiming to be an invoice. When you open the attachment ransomware is installed on your company’s network and data is encrypted. The cybercriminals then ask for a substantial sum to release the data.

Targeted Phishing Attacks

Most of the above types of phishing are sent out in large numbers to lots of unsuspecting victims. However, phishing scams can be highly targeted to increase the chance of them being acted on.

Spear Phishing and Whaling: Spear phishing is a form of phishing where scammers customise messages for specific individuals or organisations, often using information that they have gathered from social media or other online sources. Whaling refers to the same type of phishing but targeted at a group of individuals.

Example: You receive an email which appears to be from your manager, requesting urgent access to some sensitive information. The email is personalised with your name and contains some convincing details about the manager and ongoing projects.

CEO Fraud or Business Email Compromise (BEC): This refers specifically to emails which impersonate company executives or business partners to trick employees into disclosing sensitive information or making unauthorised payments.

Example: You receive an email which appears to be from your managing director which is instructing the finance department to urgently transfer funds to a specified account for a business transaction. The email sounds convincing and includes details about some recent company activities.

Are you sure you should be clicking on that website link?

As part of a phishing campaign, scammers will set up fake websites to lure you into downloading malware or giving away sensitive information.

Clone Phishing: Refers to when attackers create near-identical copies of legitimate emails and websites.

Example: You receive an email from what looks like a legitimate retailer with a special offer, with a link to claim the discount on a fake website.

Pharming: Is when attackers hijack a legitimate website and redirect users to a fake website mimicking the original.

Example: You receive an email from a popular e-commerce website with the offer of a voucher, when you visit the site, you are actually redirected to a fake site that steals your login credentials.

Search Engine Phishing: Cybercriminals are also using search engine results to promote their own ads and malicious websites.

Example: You search for “free antivirus software” and are directed to a phishing website that leads you to download malware instead of what you are really looking for.

3) Tips for avoiding phishing scams

When cybercriminals contact you via email, text, phone or social media, they will often pretend to be a company or person that you trust. There are ways to identify phishing messages, but it is getting harder and harder to spot, especially with the rise of generative AI and creation of deep fakes. Deepfake videos can be created to impersonate celebrities, politicians and CEOs and voices cloned to enable scammers to impersonate people over the phone in voice messages. AI is also being used to generate more realistic and believable text in social media posts and emails.

Questions to ask yourself so you don’t fall for the scam

There are, however, still some general questions to ask yourself to ensure that you don’t fall for the scam.

• Do you recognise the person or company sending the email, and does it look like a reasonable request? If you are not sure, check the identity of the person sending it via other alternative means, such as phone.
• Does the message look right? Phishing emails and text messages often contain misspellings, grammatical errors and badly written text and are not addressed to you individually. Although messages are becoming more sophisticated now that cybercriminals are using generative AI to create more authentic looking messages.
• Is the message written with a sense of urgency or a specific deadline or demand to respond immediately?
• Are you being asked to provide personal details, such as emails, phone numbers, etc.? Or, for you to go to a website to fill in information that might be sensitive?
• Are there any links to click on to download information or attachments? Don’t click on links or download pdfs.

What to do if you think you are being “phished”

• Check the contacts identity and links – If you receive a suspicious call or message from someone that doesn’t feel quite right, always check the person’s identity through some alternative means, such as an official company website, via another phone number or other channel. As mentioned above, you can also hover over the URL or the email address to ensure that it looks legitimate
• Report the suspicious communication – via an email Phishing Reporter (so that your IT department are informed immediately). You can also report them to the NCSC.
• Spotting a deep fake is not impossible – carefully check for visual and audio clues, such as inconsistencies in the image, blurry and distorted areas and robotic voices without the natural inflections and emotions you would normally expect.

Do you have the security measures and knowledge in place to stop phishing?

From an IT perspective it is important to make sure that you have:

• Technical security measures in place to prevent phishing attacks
• Up to date information on the latest types of phishing
• Regular phishing training and information for employees in place
• Frequent phishing simulations to test employee awareness.

If in doubt, a managed service such as the one from School of Phish can help if you don’t have the expertise in house.

For everyone in the company, don’t just rely on your IT department – make sure you are aware of phishing scams and:

• Use multi-factor authentication for access to systems, so that cybercriminals are less likely to gain access.
• Read these guidelines to understand how to spot phishing
• Make sure you do regular phishing training
• Report phishing with a tool like School of Phish’s Phishing Reporter in Microsoft Outlook to report potential phishing threats.

Don’t just rely on your IT department – make sure you are aware of phishing scams. Find out how School of Phish can help >