How to Spot Phishing Emails and What to Do When They Do
Phishing is a cyberattack that leverages trust, fear, and a sense of urgency to trick users into revealing confidential information or downloading malware. Despite advanced cybersecurity technology, even the most perceptive employees can fall prey to these attacks, so teaching staff how to recognize suspicious messages and what to do when they receive one is vital.
The most common giveaways that an email or message is phishing are the lack of personalization and a sense of urgency. Attackers often impersonate organizations like banks, payment services, and retailers to create a sense of urgency, or even the government, in order to scare victims into divulging sensitive information. In addition, attackers frequently misspell domain names or use shortened URLs to make their links look legitimate and fool security tools.
Similarly, attackers commonly use generic greetings to appear less professional and make recipients more receptive to the request. Additionally, attackers often include an uncharacteristic time stamp to bypass standard business hours when vigilance may be lower.
In addition to these visual tells, attackers can also spoof identity cues on a call or video conference (Zoom/Teams/Meet) using AI voice cloning and face-swapping techniques. They may also push recipients to skip standard verification procedures, such as password resets or the sharing of MFA codes, in order to exploit their sense of urgency.
Educating employees to pause and assess rather than immediately respond to unusual emails can dramatically reduce the impact of successful phishing attacks. Encourage your team to verify the legitimacy of a message by calling the organization or person directly. Also, teach them to check the address in the “From” field and look for differences in the actual vs. displayed URL (revealed by hovering over the link), and to be wary of any hyperlinks that do not contain additional content.