How to Spot Phishing Emails and Fake Websites
Phishing is a cybercrime that uses emails and fake websites to steal personal information such as credit card numbers or passwords. Attackers use these credentials to access corporate networks, where they can wreak havoc by making fraudulent payments or stealing confidential data.
Attackers can spoof the email address used by victims to appear to come from trusted organizations such as banks, universities or employers. They can also spoof the website’s domain name to look like an authentic one. Using an SSL certificate to make the fake website appear secure, attackers attempt to trick victims into entering their private information.
Display name spoofing is the most common method of phishing attacks. This involves attackers identifying themselves to the victim by exploiting public resources, including social media, to obtain information about their identity, work history and interests. Then, they impersonate a trusted person in the victim’s organization and send an email to them asking for private information or payment instructions.
Urgent or threatening language in an email is another red flag. Legitimate companies will never request sensitive information or prompt for urgent action via email.
Hovering over a link (without clicking) can reveal its true destination. Shortened links or those that are hidden with services such as Bitly can also be a warning sign. Also, check if the website has an SSL padlock — this signifies that it is secure. If not, this is a good indication that the site is bogus.