Don’t Click and Tell (Tips on Avoiding Phishing Scams)

Links are essentially mechanisms to relay data or commands to your gadget. In most instances, we receive links from trustworthy sources. But, that's not always the case. Bad cyber actors are increasingly using links to trick unsuspecting users into downloading malicious attachments like malware or divulging their critical credentials.?According to FAU researchers, an alarming 78% of American workers click links from unknown sources despite knowing the underlying cybersecurity dangers.?

A day may not pass before you receive an invitation to click a link, either from a known brand, friend, politician, or even a stranger. On clicking these links, they redirect you to other pages or automatically download files into your devices. You've probably gotten used to this that you barely think twice before clicking on a link. Where does it take you? Who is the sender? Which credentials does it require? Here's why you should not click links from unknown sources and enter your sensitive information:

Malicious Links Expose You to Phishing and Spoofing

The two greatest cybersecurity threats from clicking malicious links are phishing and spoofing. Here’s a little explanation into each:

1. Spoofing

Spoofing is when an actor uses an email address, phone number, website URL, or sender name that looks like it's from a known source to make you believe that you're interacting with a trustworthy correspondent. They typically do this by changing just one symbol, number, or letter in the genuine source's details.?For instance, if the actual email address is [email protected], they can create a similar account with the address [email protected]. Unless you're incredibly keen, you might not notice the slight difference.

Cyber attackers rely on convincing unsuspecting users that spoofed communications are genuine. A typical spoofing email, text, or call will ask you to reveal sensitive financial or personal information, wire money, or prompt your device to download a malicious file. A perfect example is the recent Barbara Corcoran phishing scam. Cyberattackers sent her bookkeeper an invoice pretending to be her assistant. The unsuspecting bookkeeper then immediately sorted the invoice and wired $400,000 US to a fake Asian account. Fortunately for Barbara, she was able to recover all the stolen money. However, most phishing scams don't end this way.

2. Phishing

Currently, phishing is one of the most successful and lethal cyber attack vectors globally. Actually, over 91% of cyberattacks start as phishing attempts. Phishing uses spoofing to lure unsuspecting users into giving cyber attackers confidential information. Most phishing scammers use emails. A common trick is hackers sending you emails seemingly from legitimate affiliates, asking you to verify your identity or update your credentials. These emails are often so similar to the genuine ones that it's not easy to tell them apart at a glance. Also, they usually have enticing words that coax you into urgently doing whatever they request.

When you open these links, they redirect you to spoofed websites that look pretty similar to legitimate sites. For instance, if the actor pretends to be your credit card provider, they will create a website with the genuine provider's logo and welcome messages. They may then ask you to enter sensitive details like passwords, pins, and credit card numbers which they steal and sell or use to access your accounts.

Phishing Scams Are on the Rise

The fact that phishing attacks are on the rise may not be news per se. What's even more worrying is that phishing actors keep on devising new scams by the day.

Phishing is no longer just about cyber attackers trying to convince you to click links that will mine your data. We now have actors impersonating Health Departments, nongovernmental organizations, financial institutions, software developers, Police Departments, and even internal users. That makes it challenging, more than ever, to distinguish between a phishing attempt and a legitimate email.

Tips on How to Stay Safe From Phishers

Ensure you keep up to date with the emerging threat patterns. Even with the best email and DNS filters, your first line of defense is your employees. If they can identify common tricks and avoid clicking malicious links, your systems will be 91% safe from breaches. Before you click that malicious link, beware of the following:

• Is the sender genuine? Do not open emails or click links from unknown sources. If you aren't sure about the sender's legitimacy, hover the cursor over the link to see their details. Look out for slight variations in numbers, names, or symbols.
• Do not be a victim of false urgency: Most cyber attackers use "manufactured urgency" to convince users to click on malicious links. In most instances, legitimate organizations will use courteous and composed tones. If you spot something like "click below or lose your account," it might be a scam.
• Look out for grammatical errors: It's uncommon for official emails from companies to have grammatical mistakes. Therefore, this can also be a sign of a spoofing attempt.
• Never give out your logins or credentials: Legitimate companies will never call to ask for your logins or passwords. Any website that asks you for sensitive information is most likely a malicious site.

LeadingIT offers 24/7, all-inclusive, fast, and friendly technology and cybersecurity support for nonprofits, manufacturers, schools, accounting firms, religious organizations, government, and law offices with 20-200 employees across the Chicagoland area.