Spotting and responding to phishing attempts/scams

Phishing is a form of social engineering attack and a severe cybersecurity threat to businesses worldwide. In this type of attack, the threat actor tricks unsuspecting employees, customers, managers, or executives into giving away sensitive information or taking actions that could jeopardize the company’s security. These actions are done through fraudulent emails, which are rigged with links to malicious websites or attachments containing malware payloads.

What makes phishing so dangerous?

First of all, phishing has become more prevalent than ever before. In the FBI’s IC3 report, phishing ranks as the most prominent cybercrime in terms of victim count. Secondly, phishing attacks are increasingly becoming more complex and devastating.

According to the Insider Data Breach Survey, phishing accounted for nearly two-thirds of successful data breaches in 2020. The report also shows that phishing is one of the top security concerns among IT leaders.

But what makes phishing dangerous is that it preys on human weaknesses. Unlike other cyber threats that exploit technical security loopholes, phishers target human judgment and emotions — playing psychological tricks to get what they want. These tricks make phishing immune to most cybersecurity defense systems. So in most cases, it’s only the target victim (usually an employee) standing in the attacker’s way, which is always a gamble. And remember, a successful attack requires only one victim to fall for the scam.

Types of phishing attacks and their characteristics

An attacker can take different phishing approaches depending on the goal and their knowledge of the target victim. Here are five common types of phishing attacks you should know about:

• Classic email phishing: The attacker sends out multiple emails to various target groups, hoping that at least one individual takes the bait. This technique is known as “spray and pray.”
• Spear phishing: This is a more targeted attack focusing on a specific person. Spear phishing emails are personalized for each target.
• Whaling: Whaling is a form of spear phishing targeting top company officials and executives (the big fish).
• Angler phishing: The attacker pretends to be a customer service agent and reaches out to customers via cloned social media accounts, websites, or forums.
• Vishing and smishing: Vishing involves phone conversations, while smishing uses text messages.

How to spot phishing advances

You don’t need to be a cybersecurity expert to identify phishing emails, calls, social posts, or text messages. It only takes a keen eye to differentiate between genuine and malicious communications. Look out for these telltale signs of phishing scams:

• Email from some unknown sender containing links or file attachments
• Odd requests in the message such as following a link or downloading and installing a program
• Vague descriptions lacking any direct or helpful information
• An email, message, or phone call asking you to log in to a specific page or provide login credentials
• Inconsistencies in the sender’s email address, domain name, and branding features
• Threats in the message
• Suspiciously off-brand context, language, or voice

Combating phishing

Ongoing employee cybersecurity training emphasizing phishing awareness is the most effective way to combat phishers. Teach your employees to quickly identify scam messages, emails, and calls. Do not engage with strangers and to report any suspicious communications to the relevant authorities. If you see something, say something.

You could also tighten your security measures to catch the attacks that slip through the employee defense line. Practical anti-phishing security measures include: 

• Enabling multi-factor authentication (MFA) for all user accounts
• Modeling the security framework around Zero Trust
• Enabling spam filters on email clients
• Deploying powerful anti-malware on all endpoints
• Installing browser add-ons that block malicious sites

There’s no doubt that phishing is a potentially devastating threat. But with the right cybersecurity approach, you can easily evade almost all forms of phishing advances. If you are unsure about your organization’s capabilities to defend against phishing or other threats, KME Systems is here to help. Contact us to learn more about our robust cybersecurity solutions for modern businesses.