Phishing – How to Spot Phishing Emails and Other Phishing Attacks
Phishing is when cyber criminals impersonate a company or trusted individual in order to trick recipients into sharing sensitive information. Attackers typically use a sense of urgency and fear to prompt the victim to act without thinking it through, leading them to click a link, enter login credentials into a fake webpage or download an attachment that infects their device with malware (APWG, 2019). Often, phishing emails contain grammar errors and formatting issues that can be telltale red flags. Additionally, a legitimate email from a credit card company, bank, payment service or the IRS will always address the recipient by name rather than using generic greetings such as “Dear Customer” or “Dear Employee”.
In some cases, attackers go to great lengths to tailor phishing messages to their targets, employing data they have gleaned through social media and other publicly available sources. This is known as “spear phishing”.
The types of messages attackers send in phishing attacks vary, but the goal remains the same: to get victims to share critical information via unsecure channels. Attackers will ask for passwords, account numbers and even credit card details via unsolicited emails, phone calls and texts. These requests are generally made when a user is expecting an update from a well-known brand, anticipating order confirmations or awaiting financial information from a vendor or payment processor.
Other phishing tactics include unsolicited support prompts, urging the victim to call a number in order to restore or re-verify an account or remove malware. These calls are almost always routed to a malicious call center where attackers impersonate IT service providers or fraud teams and try to social-engineer credentials, one-time MFA codes and install remote access tools.