I have recently received a disturbing and really worrisome email about my email password that’s going to expire. I need to “reset my password within 24 hours or I will lose all my emails.”
To anyone else this would be so stressful, however, I just scoffed. Because I am the host of my own emails… and as the Hosting provider I can assure myself I have put no such procedure in place.
It dawned on me, if I’m getting this email, then surely other people are too. A few days later, a customer of mine also sent me a very similar email.
He hosts his domain/email account with a popular South African ISP. He was so worried about his emails and I assured him its a scam, and he’s not to click on any links. “Delete the email” was my last instruction.
So, here we are. I would like to teach you about Phishing scams. This is a long but very important article.
Please feel free to give me a call or pop me an email if you have any concerns of your own.
What are Phishing Emails?
Phishing attacks attempt to steal sensitive information through emails, websites, text messages, or other forms of electronic communication. They try to look like official communication from legitimate companies or individuals.
What do they want from you?
Cybercriminals often attempt to steal usernames, passwords, credit card details, bank account information, or other credentials. They use stolen information for malicious purposes, such as hacking, identity theft, or stealing money directly from bank accounts and credit cards. The information can also be sold in cybercriminal underground markets.
Social engineering attacks are designed to take advantage of a user’s possible lapse in decision-making. Be aware and never provide sensitive or personal information through email, unknown websites, or over the phone.
Remember, phishing emails are designed to appear legitimate.
The best protection is awareness and education.
Don’t open attachments or links in unsolicited emails, even if the emails came from a recognized source. If the email is unexpected, be wary about opening the attachment and verify the URL.
Enterprises should educate and train their employees to be wary of any communication that requests personal or financial information. They should also instruct employees to report the threat to the company’s security operations team immediately.
Here are several telltale signs of a phishing scam:
- The links or URLs provided in emails are not pointing to the correct location or are pointing to a third-party site not affiliated with the sender of the email.
- There’s a request for personal information such as Identity numbers or bank or financial information. Official communications won’t generally request personal information from you in the form of an email.
- Items in the email address will be changed so that it is similar enough to a legitimate email address but has added numbers or changed letters.
- The message is unexpected and unsolicited. If you suddenly receive an email from an entity or a person you rarely deal with, consider this email suspect.
- The message or the attachment asks you to enable macros, adjust security settings, or install applications. Normal emails won’t ask you to do this.
- The message contains errors. Legitimate corporate messages are less likely to have typographic or grammatical errors or contain wrong information.
- The sender’s address doesn’t match the signature on the message itself. For example, an email is purported to be from Mary of Contoso Corp, but the sender address is john@othercompany.com.
- There are multiple recipients in the “To” field and they appear to be random addresses. Corporate messages are normally sent directly to individual recipients. And usually BCC’ed so you don’t see the other email accounts for security reasons.
- The greeting on the message itself doesn’t personally address you. Apart from messages that mistakenly address a different person, greetings that misuse your name or pull your name directly from your email address tend to be malicious.
- The website looks familiar but there are inconsistencies or things that aren’t quite right. Warning signs include outdated logos, and typos, or ask users to give additional information that is not asked by legitimate sign-in websites.
- The page that opens is not a live page, but rather an image that is designed to look like the site you are familiar with. A pop-up may appear that requests credentials.
I hope this article has enlightened you and you will think twice about replying to any messages or questions and never click on any links in any emails that you are not sure of.
Contact your IPS or service provider if you are unsure.
Stay safe and if you have recently clicked on something or given your passwords to a site you’re not sure of, please change all your passwords today. Ensure they are strong passwords and try not to use the same password on all your accounts.
And this morning I received this – as mentioned in the above article here are the mistakes they’ve made.
- Spelling mistakes: Confirme
- Links that don’t match: see how the link says postoffice.co.za – but when you hover with the mouse it has a completely different address!
- = spam please don’t action these emails.
