Cyber criminals deploy mass phishing attacks, affecting thousands of businesses at once. To stay safe, employees and business owners should be able to spot a threat and know what to do if they are targeted by a phishing attempt.
Phishing is Effective
Falling for a phishing email is more likely than most assume. Without proper training for employees and protection software, your business is vulnerable to an attack.
involve phishing—a well-executed attack could easily lead to loss of data and downtime.
Small Businesses are Targeted
Because of their size, small businesses are less likely to have strong cyber security defenses in place, making them an easy and common target for cyber criminals. On average, small businesses experience 350% more phishing attacks compared to large enterprises.
**
**
This, combined with the usual lack of security awareness and email security, results in more small businesses facing losses.
How to Spot Phishing
Some phishing attempts are obvious and easy to detect, but attacks have become more sophisticated and effective than ever before. With the rise of AI, fake emails can bypass email security software and are almost indiscernible from legitimate messages.
The following are telltale signs of a phishing scam:
1. Money/login requests
Most of the time, cyber criminals are after sensitive information or funds. A common tactic used is to pose as an authoritative figure in the company, such as a manager or the CEO, requesting a transfer of funds, credentials, or personal information. They count on employees not second guessing their higher-ups and simply completing the request. Employees should always double-check using a method other than email before exchanging money or any sensitive information.
2. Emotional Manipulation
Phishing attacks rely on their victims to act hastily and without verifying the information being presented to them. A message urgently requesting an immediate transfer of money or any type of data is most likely a phish. Pressing messages are used to manipulate the user into quickly completing a request out of fear of things like losing clients, missing deadlines, or affecting the company if they don’t act immediately.
Good news is also used to manipulate users into falling for a phishing scam. For example, an employee might receive an email stating they are receiving a raise and need to click the link attached to accept the offer. This type of news might make the user click the link without checking its legitimacy.
Whether it be positive or negative, emotional triggers are used in hopes of users acting before realizing the message was a phish.
3. Domain name/email mismatch
It’s easy for cyber criminals to make an email seem like it is coming from a legitimate source, whether that is another internal employee, a client or vendor, or a reputable website. Sender names can be easily imitated, so they are not a reliable way to confirm the validity of an email.
A quick way to ensure an email is secure is to make sure the email address and the sender’s name match. Don’t rely on the sender’s name alone—check that the actual email address is correct and from a trusted domain. For example, an employee receives an email from John Doe, a trusted client, asking for sensitive information about their most recent invoice. Before the employee sends the information, he notices that the email states the correct name, but the address itself is johndoe@faultydomain.com. Now, it is apparent that this is not John Doe requesting the information. This simple detail helped the employee successfully spot a phishing email and prevent a data breach.
4. Look-alike URLs
Like the name/email mismatch, this type of phishing email will prompt users to open a link to a seemingly reputable site but will have a slightly different URL than the real site. For example, if a business is expecting a package, an employee might receive an email from Amazon saying their order was cancelled and they must click a link in the email to approve the order. Instead of the link leading to amazon.com, it will lead to amaz0n.com.
The user might not even see the link itself and only see a button to press. Hovering over a link or button will reveal what site it will lead to before actually clicking the link. This simple check can stop an attack before it happens.
5. Phishing trigger words
Phishing emails will often play on the victim’s emotions and involve sensitive information or money. If you receive an unexpected email containing certain words in the message, a link, or an attachment such as a PDF or image, it is likely a phishing attack. Common trigger words include:
- Invoice
- Required
- Request
- Action
- File
- Document
- Verification
Opening an attachment or link from an email can lead to malware being downloaded to the device. It is always possible for an email containing these words to be legitimate—the combination of two or more signs of a phishing email should alarm users. In this case, it is best practice to be especially cautious.
6. Bad grammar/spelling
This is one of the most obvious signs of phishing. While AI aids many cyber criminals in writing phishing messages, they are still prone to errors. If a message does not make sense, is littered with misspelled words, or contains unusual phrasing, chances are it is a phishing attack.
Even if not all phishing emails are poorly written, this can still be a strong warning sign.
7. Odd/unfamiliar greetings
Messages coming from trusted vendors, clients, or employees have recognizable greetings. If an email greeting does not include the receiver’s name and the message does not include any specific personal or company details, chances are it is a mass phishing campaign. Because the message was sent to people across different companies, industries, etc., cyber criminals cannot include any user-specific details.
Mitigation and Response
It is important to empower your team to identify phishing attacks with tools such as security awareness training.
Establishing rules, such as prohibiting the transfer of sensitive information via email and always verifying money transfers through a second channel, can make it much easier for employees to avoid mistakes.
Additionally, create clear guidelines when dealing with phishing emails. Outline steps for employees to follow when unsure of an email’s legitimacy, including a way to report suspicious emails. There should be a comprehensive response plan ready in the event of a breach, not after a security incident.
Conclusion
SMBs and SMEs are targeted by cyber criminals at an unprecedented rate, and these 7 details can help businesses identify phishing attacks and prevent data breaches. However, they are not always foolproof. Additional measures, such as email security, are essential to help small businesses defend against these threats.
to Makios Technology to learn how we can best help secure your business.
