How to Avoid the Lure

of Phishing Scams

Think your business is safe from phishing scams? Think again. With the sophistication and volume of phishing attacks on the rise, your company cannot afford to take cybersecurity for granted. Knowing how to prevent phishing scams is one of the most effective steps you can take in the war against data breaches.

A 2020 study found that phishing attacks have hit 85 percent of all organizations. This is due to the widespread transition to remote work without proper preparation and added cybersecurity measures. Phishing scams have become one of the most common ways to acquire sensitive information and distribute ransomware, resulting in the loss of millions of dollars on a global scale.

With cybercriminals ready to use whatever means necessary to exploit vulnerabilities, it has become increasingly important to learn how to prevent phishing scams and avoid falling victim to these traps.

How Do You Recognize a Phishing Attempt?

A phishing scam happens when someone impersonates a trustworthy entity, like your boss, a bank or a credit card company, to obtain sensitive information. Types of information sought commonly include:

• Username and password

• Social Security numbers 

• Financial information

• Account numbers 

Phishing attempts usually create a sense of fear or urgency to make targets act quickly instead of thinking carefully about sharing private information.

While phishing scammers regularly update their techniques, there are several indicators to help you identify a phishing attempt:

Suspicious Activity or Login Attempts

Many online services send emails to notify you if someone has attempted to log into your account from a new device or location. If you don’t recognize this activity, that could indicate a phishing attempt.

Fake Invoices

Scammers sometimes pose as contractors or vendors to trick employees into paying counterfeit invoices using company funds. One scammer posed as a legitimate company to trick Google and Facebook into paying him a combined $122 million.

Links to Make Payments

Phishing scammers might try to trick users into clicking on links that lead to phishing sites disguised as authentic websites. After the user enters their username and password, the scammer then uses the login information to access their online account and lock them out.

Coupons or Free Offers

Some phishing attempts use free offers to entice people to open suspicious emails, click on links or share personal information that can access other online accounts. 

Confirmation of Personal Information

Some phishing attempts manipulate people into revealing personal information. Scammers can use birthdays or Social Security numbers to answer security questions and “prove” their identity as the account holder.

Refunds Not Owed to You

Phishing scammers have even impersonated the IRS and contacted people about a pending tax refund. The scam requires that targets provide personal information like an address, date of birth, driver’s license number or electronic tax-filing PIN.

“Problems” With Your Payment Information or Account 

Phishing attacks can also trick users into sharing financial information by posing as an e-commerce site or online service asking users to confirm their payment information. 

Common Phishing Lures

A 2020 study from Verizon Enterprise found that 22 percent of data breaches involved phishing. An essential step in avoiding phishing scams is learning how to recognize different phishing attacks. Here are the seven most common types of phishing attacks:

1. Deceptive Phishing 

Deceptive phishing is the most common type of phishing scam. A scammer impersonates a legitimate source to trick people into sharing their personal information or login credentials. Deceptive phishing emails often use threats to scare users into giving away sensitive information.

Pro tip: Deceptive phishing attempts typically include generic greetings, grammar or spelling errors, and redirected or shortened links that lead to phishing sites. You should always verify that a sender is legitimate before clicking on a link or downloading attachments.

2. Spear Phishing

Spear phishing uses personalized information, usually gathered from social media, to target specific users for a higher success rate. These phishing attempts customize emails with the target’s name, position and even phone number to make the target believe the sender knows them. However, the goal remains the same: to trick the target into sharing personal data, clicking on a link to a phishing site or downloading malware.

3. Whaling

Whaling is a specific type of spear phishing attack that targets executives to access high-level corporate data and accounts. If a whaling attack is successful, a scammer might conduct CEO fraud. CEO fraud uses a CEO or other executive’s account to authorize fraudulent wire transfers or request employees’ W-2 information, which they can sell on the dark web.

Whaling attacks are highly successful because executives typically do not receive the same security awareness training as their employees. To combat the risk of CEO fraud, organizations should require that executives participate in ongoing cybersecurity training.

4. Clone Phishing

Clone phishing attacks duplicate legitimate emails to appear trustworthy and replace legitimate attachments or links with malicious versions. Clone phishing emails often come from spoofed email addresses and refer to a previous message or claim to include updated information or files.

Pro tip: Users should always verify links, even if they come from a seemingly trusted source. If in doubt, contact the supposed sender directly in a new email instead of replying to a possible clone phishing email.

5. Smishing

Smishing, a combination of “SMS” and “phishing,” uses text messages to trick users into downloading malware or sharing personal information. In smishing attempts, scammers impersonate known entities (like a vendor or your financial institution) to manipulate targets into downloading a malicious app or filling out their personal information on a phishing site.

Smishing campaigns have posed as highly trusted entities like the U.S. Postal Service, FedEx and Apple. Users should be wary of messages sent from unknown phone numbers and call the organization directly to verify a message’s authenticity if they are unsure.

6. Pharming

Unlike traditional phishing scams, pharming does not always target victims directly. Instead, pharming changes a legitimate website’s domain to redirect users to a phishing site. Some pharming attacks send emails that modify the host files on a target’s computer and redirect all URLs to a phishing site that installs malware or steals personal information.

Pro tip: Employees should only enter their login credentials on HTTPS-protected websites and regularly update their antivirus software on all devices.

7. Angler Phishing

Angler phishing happens when scammers pose as the customer service account of a brand on social media. The scammer will then contact users who post complaints and share a link pretending to redirect the target to a customer service chat. However, the link usually leads to a phishing site that steals the target’s information or downloads malware on their device.

Pro tip: Users should verify an account before engaging with it or visit the brand’s customer service center directly to address complaints.

7 Tips to Avoid Phishing Scams

Phishing scams have existed almost since the beginning of the internet, which has an unexpected upside. Because phishing attempts often follow a familiar pattern, there are many reliable tips to avoid phishing scams. Here are seven recommendations on how to prevent phishing scams.

1. Get Educated — Then Train Your Employees

Phishing attacks use social engineering to psychologically manipulate people into revealing sensitive information without realizing they’re being tricked. You should conduct regular security awareness training to educate your employees on preventing phishing scams and identifying suspicious emails.

You should monitor the latest phishing trends and techniques so you can prevent phishing attacks before they affect your business. Frequent simulated social engineering testing can also radically reduce your business’s vulnerability to phishing scams.

2. Trust Your Gut (If Something Looks Suspicious — Don’t Click!)

If an email sounds too good to be true, then it just might be. Scammers often target people with free offers or unexpected refunds to trick them into opening a suspicious email or clicking on a link that leads to a phishing site. Always hover over links before clicking them and go directly to a website instead of clicking a link you’re not sure about.

3. Use Security Software

Rather than doing all the work of researching new phishing scams yourself, you can install security software that does that for you. Security or antivirus software is regularly updated with new guards against software vulnerabilities and recent phishing attacks. Antivirus software is a highly effective tool that can prevent damage to your network by scanning every file that comes through your computer system.

4. Change Passwords Regularly

A Google survey found that at least 65 percent of people reuse the same password on some or all of their accounts. By regularly updating your passwords, you can protect your organization from the aftermath of data breaches, where leaked passwords are often shared or sold to other scammers. 

5. Use Multi-Factor Authentication

Multi-factor authentication, or MFA, is a verification method that requires users to identify themselves through various measures. MFA creates additional layers of protection for your accounts, securing your network and corporate data from unauthorized access.

6. Use Firewalls

A high-quality firewall is one of the most reliable ways to protect your network from external intruders. The combination of desktop firewall software and network firewall hardware can drastically reduce the risk of phishing scammers infiltrating your network.

7. Back Up Your Data

Having a reliable data backup and recovery strategy is vital for your organization’s long-term success. Cyberattacks, human error, equipment failure and natural disasters can all cause data loss. Protecting your business against these unexpected occurrences can prevent you from experiencing a costly or unrecoverable data failure.

Prevent Phishing Attacks Before They Happen With SugarShot

Is your business protected from growing cyber threats like phishing scams? Partnering with a trusted managed IT services company can give you peace of mind about your business’s cybersecurity strategy.

At SugarShot, we take a proactive approach to IT security by weaving cybersecurity into everything we do. With greater insight and efficiency, we can provide you with customized cybersecurity solutions that help your team and IT systems operate at peak performance.

To get a free security audit of your business, contact us today.