Have you ever received a dodgy email? One that’s from an account you didn’t recognise, or someone asking you for details they wouldn’t normally ask for, or an email with an odd link? Chances are that it was a phishing email. Hackers and scammers alike have been using these for years to try and gain access to personal details.
Phishing is an attempt to gain information about a user or company by making the person think they are providing their details somewhere else, these are often then used for malicious reasons. More often than not a phishing email will try and imitate someone you know, or a trusted service (for example a bank), but sometimes they are just random emails that only contain a single link or attachment and they rely on people’s curiosity to click it.
Recently we had a client fill out their details on a phishing email that they believed to be from a legitimate source, but it was not. This mistake cost their business $18,000. We were able to get this client secure again, but unfortunately we had no way of retrieving the money that had already been taken. So, how could they have avoided this? How can you tell that an email is out to get your details? Most phishing emails are called Mass-Scale Phishing; they are vague emails that are sent to millions of people, hoping that a few of them will fall for it and enter in their details. You can often detect these by:
- Checking the senders name – Is it spelled correctly? Is it someone you know?
- Checking the email address it came from – If it is someone you know, did it come from their email address? Always verify if it has come from a business (Microsoft, a bank, etc) that the domain is correct, that it’s @microsoft.com.au not @emails-microsoft.com.au or anything like @randombusinessname.com.au
- Checking who it is addressed to – A bank or a company would use your correct name, as would someone you know. They wouldn’t address an email with “To whom it may concern”
- Grammatical and spelling errors – Does the email make sense? If it is full of weird sentences and misspelled words, it’s probably not a legitimate email.
- Scare tactics – “If you do not pay within 30 days all of your mailbox will be deleted” companies do not often use tactics like this to get their customers to pay, anything that’s trying to scare you into doing what they say should raise suspicion.
- Imitating a brand – If you weren’t expecting an email from your bank, or your email provider, contact them directly by phone and ask if they sent you this email as it appears to have come from them. Most facilities often have a spam reporting service that they will then ask you to forward the email to.
- Checking the links that are in the email – Do not click the links. But in an email when you are given a link if you hover your mouse over it, it will bring up a little box telling you exactly where that link will take you. If the link in the email says https://www.ccp.com.au but when you hover over the link it wants to take you to (for example) https://www.facebook.com.au, that’s a sign that the email is dodgy.
- Attached .zip files – For most of our clients we block the download of .zip files, as these can often contain malicious software. If you receive an email from an unknown source, or even a known source that seems suspicious, do not download any files and if you have downloaded any, definitely do not open or run them.
Note: Google does not have public phone numbers that people can contact. If you have received a contact number for Google or another big service company, it is likely fake and the people that you speak to will not actually work for that company. In a worst case scenario, if you really aren’t sure about an email, ignore it! If it’s real, you will be contacted again and it’s better than risking yours and your business’ security.
There are also Spear Phishing Emails; these will directly target one person or a few within a business, typically someone of importance in a company. These can be slightly harder to detect as they often are very well thought out and can come from an email address you know. The same rules as above apply for detecting one, but if you are still struggling, check:
- If you were expecting an email from that person
- Is it a request they would normally ask?
- Does it seem suspicious?
If it has come from someone you work with, simply get up from your desk and ask them if they sent it to you. If they did not, chances are that their email account has been compromised.
If you have any troubles with phishing emails, or suspect something might have happened within your company, feel free to give us a call. We are always here to help. There are many other forms of phishing as well that are less seen in a business environment, but more seen in day-to-day life. If you would like to learn more about these, please check out this infographic.
