How to Spot a Phishing Attack

Despite its eccentric name, phishing is a very significant threat to everyone, especially modern businesses. Thus, you must be prepared to identify its warning signs and circumvent risky situations. Listed below are a few tips to prevent you from becoming a phishing victim; make sure you share them with your employees as well!

Habits to Help You Thwart Phishing Attacks

When you and your staff have developed the following habits, the chances of a phishing attack tricking one of you diminishes greatly… but not entirely. Attackers are always coming up with new and clever methods to pull the wool over their targets’ eyes, and there’s always the chance that you or one of your team members could miss one of the warning signs.

This is exactly why it is so imperative to turn the following activities into learned, automatic behaviors.

Examine Links Before You Click Them

Links are very convenient thing - all you have to do to go to the website you want to visit is click on the right link. Nonetheless, cybercriminals will put wrong links into their messages (often disguising them) in an attempt to take advantage of this tendency. You need to get into the habit of taking a moment before clicking through any link you see and simply hovering your cursor over it.

This will display the URL the link directs you to, giving you the chance to confirm that the link is legitimate before clicking through.

Know How to Identify Fraudulent Links 

Speaking of whether or not a link is legitimate, there are a few warning signs that hackers are counting on you to overlook.

You receive an email that appears to come from Amazon, offering some really impressive deals on some furnishings that your business could use. The critical factor is that it is something that definitely interests you… but is it actually coming from Amazon? As stated above, the URL can help you determine whether or not the message is legitimate.

Where in the URL does the last “dot” (as in, “dot-com”) appear? In a legitimate URL, the last dot would be the last one in the domain. 

• [amazon.com/deals/offers] - As the last dot is the one in “dot-com,” this link should be safe to click through.
• [amazon.com.deals/offers] - This URL should not be clicked on, as there is an additional dot after the domain.

Examine the Sender

Who is the email actually coming from? It may look like any other email from Amazon, or eBay, or PayPal, or whatever the case may be, but a skilled cybercriminal could have replicated their design with little trouble. What would be more difficult for them to do would be to hide the email address that displays in the header. Pay close attention, as these attackers have had to become really clever with how they disguise their trickery.

Sometimes they’ll omit letters, so the URL still looks close enough to the real one to pass the “quick glance” task. Quickly skim through this list:

• amazon.com
• google.com
• ebay.com
• payal.com
• reddit.com
• visa.com

Did you catch the fake URL? If you didn’t, look again more carefully. Since our brains are expecting certain letters to be there, we can subconsciously insert them into what we’re reading. 

Likewise, we can still read words that are scrambled up, so long as all the right letters are still there and the first and last ones are in place. In fact, that list could just have easily included the URL for “papyal.com,” or some variation of another URL. Carefully checking each time you open your email will take perhaps a half-second longer, but could prevent a much more time-consuming issue.

Taking the few moments to go through these steps won’t interrupt your day too much, but will help keep your business safe. For more assistance with your security and assorted other IT tips, keep checking back in with this blog, and reach out to Macro Systems at 703-359-9211.