What Is Phishing? How to Recognize and Avoid It

Step 3: Bait the Hook

Once the attacker captures the victim’s attention with a convincing lure, all that’s left is to provide a hook for the victim to bite; the two most common are malicious attachments and embedded links.

Malicious Attachments

When opened, a malicious attachment typically delivers malware to the victim’s system. Depending on the type of malware, it gives the attacker an opportunity to do any number of things, from logging the victim’s keystrokes and reporting back to the attacker, to stealing data, taking over the entire system, or holding it ransom. Note that an attachment isn’t the only way attackers deliver malware, however. When clicked, images, gifs, and videos embedded in a message can also automatically download malware used by phishers.

Malicious Links

Three times more common than an attachment is a malicious link included in the content of a message. When the victim clicks the link, it takes them to a fake website created and controlled by the attacker. These types of hooks are especially common in messages that appear to be from financial institutions, such as the victim’s bank or credit card company. When the victim unknowingly visits the fake site (users often don’t notice the fake URL), the attacker captures the victim’s credentials and then logs into the legitimate site to steal their money or make large purchases.

Phishing Kits

In recent years, it has become easier for even the least experienced cybercriminal to create a phishing website, thanks to the availability of phishing kits. Often designed to target well-known brands such as Microsoft or Apple, the kits are virtually turnkey solutions that include the HTML and supporting code, email templates, sample scripts, and images a would-be attacker needs to mimic a legitimate website.

Step 4: Reel in Victims

Attackers are only able to reel in victims if they take the bait, so the more polished, professional-looking, and convincing the lure is, the more likely a victim is to bite the hook. Once they do, in the case of downloaded malware, the damage is done; the victim might not discover the malware for months or even years. Victims who unknowingly visit a fake website still have a chance to escape if they become suspicious of the URL or the information being requested and abandon the site before supplying any information.

Why Phishing Works

Phishing is an easy trap for anyone to fall into for one simple reason: most people are naturally helpful and trusting of others; they don’t go about their daily lives constantly on guard or expecting to be conned. That’s why impersonation and social engineering are central to the success of phishing attacks. And while ordinary consumers who are not trained in security practices might fall prey more easily to phishers, no one is immune. Given the right conditions—fatigue, stress, illness, distraction—anyone, including corporate executives, system administrators, and security professionals can be taken in by phishing scams.

Recognizing Phishing Attacks

The first step to avoid being a victim of phishing is to recognize the signs. The following are the most common red flags that could indicate a phishing email:

• An incorrect, obscure, unusually long, or otherwise suspicious-looking sender address.
• Requests for personal or business information in any unsolicited message.
• Requests that you change account details or perform other online activities.
• Requests for personal information from seemingly official institutions. (Legitimate financial institutions and government agencies never do this.)
• Any message that uses fear, threats, a sense of urgency, or an offer too good to be true as a motivator.
• Any message with a subject containing words like “Action Required!,” “Urgent!”
• Any message that contains an odd or unexpected subject matter, incorrect grammar, punctuation errors, misspellings, etc.
• Messages from trusted parties (friends, co-workers, company executives) that request personal information (address, phone number, personal email alias) or that seem “off” in subject matter, tone, grammar and structure, embedded links, time of day sent, etc.
• Embedded URLs that contain misspelled names or substitute characters (for example, b@nkof1ndiana.com (where the numeral 1 is meant to look like the letter I) or arnazon.com, where the space between the r and the n is condensed to appear like the letter m.
• Shortened URLs, which often direct users to phishing websites.
• Messages sent to an unusual or unlikely group of recipients.
• Messages with an awkwardly worded or non-specific greeting (Hello Customer, Hi Dear) or use a full name (Hi John Doe).

Watch for similar warning signs in other delivery platforms such as text messages, social networking sites, and Internet forums.

How to Avoid Phishing Scams

As much as we all might like to live in a “trust but verify” world, none of can afford to do that anymore. The digitally interconnected world we live in today is rife with online fraud because it offers cybercriminals limitless opportunities for impersonation and anonymity. Whether we like it or not, we all must adapt our attitudes and behavior to a “never trust, always verify” approach if we want to avoid being victimized.

Recommendations for individuals:

• Be cautious about all unsolicited email and text messages.
• Hover over embedded links (without clicking) to reveal the actual URL and compare it the link that’s shown.
• Never click embedded links, even if you think they’re trustworthy. Instead, use your browser to search for the correct URL.
• Never open attachments of any kind in unsolicited email. In email from known senders, separately verify attachments before opening them.
• Use anti-virus and anti-malware on your personal devices and keep them updated.
• Use multifactor authentication on every account that offers it to prevent cybercriminals from accessing your accounts.
• Use a password manager to avoid credential stuffing attacks.

Enterprises can help to mitigate phishing attacks by implementing the following security controls.

• Conduct regular and continually updated user training; this your most powerful weapon and should not be considered optional. Train users in attackers’ latest phishing tactics and how to recognize and respond to phishing across all delivery mechanisms (email, text, IM, social networking, and malvertising).
• Deploy multifactor authentication (MFA) to prevent credentials that have been compromised in phishing attacks from being used by attackers to access other apps and resources.
• Use anti-virus and anti-malware solutions to automatically quarantine suspicious files and prevent installation of malware.
• Use a web filtering solution to block outbound traffic to phishing sites when employees inadvertently click malicious links.
• Make it easy for employees to report suspected phishing emails.
• Inspect SSL/TLS-encrypted traffic to detect encrypted malware.
• Inspect URLs within email messages to detect links to known malicious websites.

Conclusion

Because phishing relies on a cybercriminal’s ability to play on human emotions and manipulate behavior, these attacks will never completely disappear. No one, even a trained IT or security professional, is completely immune to the ploys of attackers. Employee training continues to be one of the most important administrative/preventative security controls enterprises can employ, alongside numerous technical controls, but we all must resign ourselves to adopting a personal “never trust, always verify” approach to online security. We’ll all be better for it.