With the build up to Christmas, & a spike in online activity… we thought it would a be good time (without ruining the festive vibe), to keep you all safe (& sound) when clicking on stuff online.
With fraudsters tailoring their efforts to con us out of our hard-earned money, we thought we’d give you a quick heads-up about Phishing emails & SMS messages from unknown senders to give you some protection when interacting with your electronic communications over the festive period.
Jokes aside, phishing… & fishing, are different! One involves the net… & the latter, involves a net. Now we’ve established the basics, let’s dig a little deeper!
Many may have heard of the term Phishing before, but what is it?
Phishing is the process of obtaining sensitive information or data, such as usernames, passwords & banking details, by disguising themselves as a trustworthy source within an electronic communication.
Usually these activities are carried out through email correspondence, instant messaging & text messaging channels, which often invite users to enter personal information and sensitive data.
Phishing emails & messages will often try to replicate the look & feel of a trusted source, imitating a reputable website or brand, & posing as a legitimate site, so identifying a fraudralent phising email can be tricky.
That said, there are many telltale signs to look out for. Here’s what to keep your eye out for & what to spot when recognising a bogus email…
So, now we know the difference between fishing & phishing, let’s look at some of the techniques used by rogue phishing companies & some of the terms associated to these processes…
First up there’s Spear Phishing. Spear Phishing are aimed at individuals or companies in an attempt to acquire sensitive information from them unknowingly.
Spear Phishing attackers often gather & use personal information about the individual they are trying to acquire data from, & use this information for monetary gain.
Within organisations, Spear Phishing typically targets specific employees (usually ones that have access to financial data or are high up in an organisation) with the view to obtain resources from them. This is often referred to as Whaling.
Then there’s a term most of you will be familiar with from a popular Hollywood film, namely Catfish. If you haven’t already seen the film, don’t worry… we wont spill any spoilers, but in a nutshell, the film is about a person liaising with somebody else online, pretending to be someone they’re not. Told you there were no spoilers!
Well, in a similar vein, Catphishing (or Catfishing) is the process of getting to know someone in order to gain access to sensitive & personal information & resources from them. , usually in the control of the mark, or to otherwise get control over the conduct of the target.
Next up we have Clone Phishing. Clone Phishing is something we have all seen at some point, but probably never identified it as such.
Ultimately, Clone Phishing, just like the other phishing methods we’ve previously mentioned, presents itself as a legitimate source. However, Clone Phishers also present themselves as somebody that you already trust.
Usually disguising their communications as a legitimate company who you have spoken to before & someone that has previously delivered mail to you, & in most instances, pretending to be a reputable organisation whom you may already have had contact and / or an account with?
Clone Phishing emails will often contain an attachment or link, but they can get rather hard to spot at a glance as endevours to replicate these platforms (both visually & by hiding & / or mimicking legitimate email addresses) can appear to be identical in some instances.
Spoofing emails to appear as it has been delivered from the original sender is part & parcel of advanced Clone Phishing methods, to be vigilent about what you’re clicking on if you have any unexpected communications via email or SMS text messages.
Now, you may be under the impression that phishing is a term related to online scams. It’s not. Many phishing attacks do not require a website, nor any online presence whatsoever.
Many phishing communications come via SMS text messaging. If you’ve ever received a message claiming to be your bank or phone network for example, it may have asked you to dial a number regarding problems with a transaction or your account?
Once the phone number (owned by the phisher & provided by a voice over IP service) is dialed, the caller (you) are usually promted to enter account numbers, PIN information & / or other sensitive information.
There’s also Vishing of course, which is a contraction of Voice Phishing) which commonly uses a fake caller-ID to mislead the target that the call is from a trusted source.
These communications can also deploy pre-recorded voice recordings to give recipients a false sense of security when answering questions when prompted.
Please take the time to double-check any communications you may receive, especially over the Christmas period, but also moving forward.
If you have anything suspicious that lands in your inbox, DO NOT click on any links whatsoever. Take the time to block the phisher & report them if necessary.
Get in touch if you have any questions regarding best practices, how you can avoid, prevent, remove & block phishing emails. or to simply help you keep safe online!