How to identify phishing emails

Phishing emails are one of the largest cybercrimes which have many wondering how to identify phishing emails to protect themselves and their organization.

Simply explained, phishing emails are created to scam a user by getting a person to click on a link, attachment, or a picture. Once you click, you gave up access.

Here are some examples of phishing emails at their best!

Tech Support Scams

Over the years, many service providers have been upgrading the customer experience by giving their clients more ways to access their team.  Unfortunately cyber criminals are using these methods so users should be aware of bad grammar, colours, odd requests, or other information that can make it look legitimate enough for someone to click.  You should pay close attention in order to outsmart the cyber criminals.

Infected Attachments

Many times, cyber criminals will try to send you malicious .HTML attachments, .JS attachments, .DOC attachments, PDF attachments, or even .XLS documents.  It is important to know that many subscription-based antiviruses put a low risk score on  for antivirus detection since .HTML files are not commonly associated with email-borne cyber attacks.  In addition financial institutions have used .HTML attachments in the past so people are used to seeing them in their inboxes.

Files with Macros

Another big increase has come to malicious macros being put in phishing emails as a common delivery method.  These documents may pass your anti-virus program.  These types of phishing emails contain a sense of urgency to create the illusion that it is important, and the persons is needed. The goal is to get a click.

Social Media Exploits

Whether it be LinkedIn, Facebook, or Instagram, if you receive a message from an account that you are not familiar with, you should already proceed with caution.   These may consist of image files or links looking to spoof real links such as YouTube.

Statistics Say it All

You can ask anyone including organizations, IT departments, managed IT services providers, managed security services providers, and IT consultants, they will all tell you that phishing, and cybercrime is at all-time high.

According to a recent report from Statista statistics website, at 11.69%, most spam emails originated in China while, approximately 9.04% out of United States.  Statista estimates that in 2020, spending on IT services from corporations is expected to reach around 1.1 trillion US dollars worldwide.

So how do these cyber criminals send out all these phishing emails?  One way is that they rely on the lax security protocols from organizations. A great tool and source is HaveIbeenPwned as it is a website that can help you see if your email is on a compromised site.

There is no way to be 100% safe online, but you should try to make it as hard as possible for the cybercriminals.

And the phishing continues to attack…

Cyber security professionals recently analyzed 55.5 million emails.  They reported that one out of every 99 messages contain a phishing attack and 25% of those phishing attacks bypass default security measures setup by IT departments and managed IT services providers.

The cyber security professionals reported the following four categories:

• 7 percent had malware
• 9 percent were harvesting credentials
• 8 percent were extortion emails
• 4 percent were spear phishing attempts
• 7 percent were marked as phishing emails
• 49 percent were marked spam
• 5 percent were white listed by admin configurations
• 25 percent were marked clean and successfully sent to the target user

Phishing emails are bypassing filters with over 323,000 pieces of malware detected daily according to Kaspersky Lab.

According to Kaspersky Security Awareness, approximately 80% of all cyber breaches or cyber incidents are caused by human error and not network setup.  Organizations are losing productivity and money when trying to recover from staff related cyber security incidents.

Unfortunately employees are the weakest link in the cybersecurity process:

• 52 percent of organizations know employees are the largest threat to cybersecurity
• 60 percent of employees have confidential data on their corporate device (financial data, email, database, etc.)
• 30 percent of employees have shared their login and password details with colleagues
• 23 percent of organizations do not have any cybersecurity rules or policies

Traditional user cyber security training programs fail to achieve behavioral changes in users.  It is important that everyone understands the security threats, and this is accomplished only by an effective educational cyber security training program.

To recap, here are some steps employees can take to protect themselves and your organization from phishing emails:

1. Check the sender address: It may look legitimate but review the sending address, if it looks odd it is probably spam.
2. Does the email ask you to click on a link or attachment? Check the sender address and the rest of the email for anything out of the ordinary including spelling, grammar, and colours.
3. Did you receive the email out of the blue? A company your never heard of or a long-lost relative is trying to send you money? Simply mark as junk and delete.
4. Does the email contain several misspelled words? It could be a phishing email.
5. Does the email contain some threat (embarrassment, prosecution for example)? It is a phishing email.
6. Does the email appear to be from someone you know or an organization you do business with? Call the person at the number you know and not the number provided on the email and verify they sent the email.

Our complimentary network and security assessment can put your IT infrastructure and business to the test.

Going to the cloud or worried about security? We are your leading Cloud Services Providers Toronto and Managed Security Services Toronto.

365 iT SOLUTIONS is Toronto’s leading IT consulting boutique firm offering industry leading IT solutions including Managed IT Services, IT Support Services, IT Outsourcing Services, Tech Support Services and Cloud Services.