A Deep Dive Into Phishing Scams

One of the most pervasive and successful forms of cyberattack is phishing. It is important to recognize the dangers of phishing so that you can work to overcome this sort of attack by cybercriminals.

Today, we’ll take a deep dive into phishing scams and you’ll learn about the goal of phishing, the different types of phishing attacks, and steps to better secure your business.

The goal behind phishing emails

The primary goal of cybercriminals who set up phishing attacks is looking to steal finances, data, or both. What does that look like?

Finances – This tends to be the primary aim of cybercriminals since it tends to be the best payoff. To achieve this, they will utilize business email compromise (BEC), ransomware attacks, or try to process fraudulent fund transfers.

Data – The theft of data might not at first glance seem as critical as the theft of your business’s finances, yet it still can have a devastating impact on your business and is still a way for criminals to cash in. For data theft, cybercriminals steal usernames and passwords, personal identifiable information (PII) like social security numbers, and also financial account information. In addition to this theft, criminals can also sell your data on the dark web.

What to look out for

• Be cautious of links in emails. These links can contain malicious software that can be used to steal data or finances. The same goes for websites that the email may direct you to.
• Cybercriminals also use attachments to deliver malicious software. The attachment might look like a normal document or voicemail, but it can deliver malicious software which will compromise your security.
• Be skeptical of emails that rush you. This might be a request to transfer funds immediately so you don’t miss out on a shipment of parts or some similar situation that conveys a sense of urgency. In these types of situations, it is good to verify the legitimacy of the request by calling the person with a number you had previously and not one located in the suspicious email.

Different types of phishing

Due to the nature of technology always changing, cybercriminals are always trying to keep pace by changing their tactics when it comes to phishing. Many people are familiar with email phishing threats and while it is the most common form of phishing, cybercriminals also use text messages, social media, and voice calls. Here are a few different kinds of phishing attacks.

Spear phishing – This type of phishing utilizes specific and personalized information to target individuals. The cybercriminal is usually looking for sensitive information like login credentials or financial account information. In addition to extracting information, spear phishing can also be used to spread malware.

Whaling – This is a form of spear phishing where the scammer targets a high-level executive in a business to convince a subordinate to do something like buy gift cards, send information, or money.

Smishing – As with other forms of phishing, this form is also primarily seeking to obtain money or sensitive information. What is unique to smishing is the attacks are sent via SMS text messages and usually claim to be from trusted sources.

Vishing – This form of utilizes voice calling to target their victims. Cybercriminals will call and pretend to be a trusted source like your bank with the intent on obtaining information over the phone. This type of attack is getting more sophisticated now with certain applications utilizing AI to make a more convincing sounding voice—even one that you are familiar with.

Business email compromise (BEC) – This is a form of spear phishing that utilizes an email that is seemingly convincing, as it might be close to the correct email domain but with minor differences. This type of attack targets employees to share company information, such as credentials, or financial account information. It is usually directed at employees that have access to sensitive information like executive level employees or those that manage company payments.

Angler phishing – This form of phishing uses social media. Scammers will target customers leaving reviews or comments and pretend to be a customer service representative from that company. They then get you to reveal account information to go and steal money.

Brand impersonation – Scammers will utilize a variety of mediums discussed above. Here their goal is to impersonate a business and try to get customers to reveal sensitive information and credentials. While this type of phishing is primarily focused on customers, it can also reflect poorly on the brand that was impersonated. This form of phishing is also known as brand spoofing.

Increasing your email security

Since email is such a critical component of any business, it is important that you implement current best practices and standards to reduce cybersecurity risk. This can be a challenge when trying to stay up to date on all the changes in today’s world of technology and we hope our deep dive into phishing scams helps your team reduce cybersecurity risks.

Struggling with email security? As always, we’re here to help.