What is it?
Phishing is the process of deceiving the user into thinking that they are communicating with a legitimate users or organisations. It heavily relies on social engineering, tricking the end user into deception. Common forms of phishing are through emails. An example of this could be when the end user believes an email has come from their boss asking to send them their bank details as they’ve lost their records. Then the unsuspecting employee sends them over thinking they are doing the right thing by sending them quickly. Bad actors can send these emails out in the masses so even if only 10 percent of the emails are successful this can lead to mass illegal financial gain.
Phishing can be fake websites. An example of this could be a password reset for Google. The end user thinks they are securing their account from an unsuspected login, but they are giving their credentials over to a bad actor.
What does it look like?
- Unusual email addresses: For example, the email could come from Facebookpasswords24@gmail.com instead of a legitimate @facebook.com email
- Greetings: Emails usually don’t contain your name and instead use Dear, or Hello,
- Spelling: Often contain spelling and grammar issues
- Design: Logos could be old/outdated or blurry
- Tone: Use threatening or urgent language such as now or immediately
- Attachments: Sometimes emails come with attachments in the form of a .eml or a .pdf to look legitimate when these are disguised and have hidden scripts
Ways to Prevent being phished
- If you suspect a link could be fake, there are websites that will scan a link so you can see it without clicking on it. An example of this is urlscan.io
- Always read the email address letter by letter to see if there are any non-Latin characters in there
- Check to see if branding and logos are current and not blurry
- If in doubt ask someone to check
