PECB Security Update

Phishing refers to one of the most widely-perpetrated forms of fraud, in which the attacker tries to get confidential and sensitive information, such as login credentials or account information, by impersonating trusted entities and using spoofed emails to lure online users that lack phishing awareness into providing personal information. Phishing can also be used to infect the victim with malware.

Typically, a victim receives a message that appears to have been sent by a known contact or organization. An attachment or link in the message may install malware on the user’s device or guide them to a malicious website, set up to trick them into revealing personal and financial information, such as passwords, account IDs or credit card details.

The world’s increasing dependence on the internet has magnified the challenges posed by scams and tricks. Consequently, phishing is progressively becoming more popular, as it is far easier to entice unsuspecting victims into clicking a malicious link from what appears to be a legitimate email, than trying to break through a computer’s defense system.

What are the different types of phishing?  

Phishing types differ in terms of the groups they target and the benefits they aim to receive. You have probably encountered the simplest type of phishing up until now, which is an email from someone purporting to be a trustworthy source, requiring information that can help you in accomplishing something very valuable (mostly money, funds, requests for tax and financial documents, or any other document that can induce the victim into sending the information that the attacker is requesting).Some of the most frequent types of phishing are:

A highly used version of whaling is the one that focuses on using the email of an executive for the mere reason of having access to the W2s of employees or the W9s of the contractors. Tax season is an exceedingly bad time for these types of attacks, as most organization's finance offices are accustomed to getting these sorts of solicitations. Such solicitations can be spoofed to originate from the IRS, or even from CPA office. The requests coming from the high-level executives in a company are most effective; however, seeming to come from IRS, they can ingrain just enough fear to stay away from the investigation.

Phishing to deliver ransomware

Even though the primary goal is gaining access to information, this type of attack is used to also get financial rewards by including ransomware in the delivered emails.In 2016, it is assessed that the majority of phishing emails comprised some type of malicious links that could lead to ransomware. These types of ransomware lock the files and photos of the users that fall into the trap of phishing email, and in most cases, the victims are required to pay in exchange for regaining access to their files. 

Vishing is almost identical to the SMS tactic, as it involves the obtainment of information from users through the phone. The only difference is that in vishing, attackers call users directly on their phones asking for their sensitive information by using an urgent scenario like the debit/credit card situation mentioned above.

• Learn how to identify suspicious Phishing emails by noticing unusual activity such as a duplicate image of a real company, copying the name of a company and using it as bait.

• Check the information source, and never respond to requests asking for passwords through email (banks never ask for passwords by email).

• Do not go to your bank's website by clicking links from emails, since they can easily direct you to a fraudulent website and steal your sensitive information.

• Install a good antivirus on your computer in order to prevent these forms of attacks. Also, you should continually update your operating systems along with the web browsers which include the latest frameworks for phishing attacks protection.

• If you need to enter your sensitive data in a website, it must include the ‘https: //’ as this is considered to be more ‘safe.’

• Avoid/delete emails claiming that you are about to receive money from anyone outside your country, as such emails have a 100% chance of being false and a trap for phishing attacks. 

• Check the accounts that you regularly use in a periodical manner to see if there is any unusual activity, be that on bank accounts, online purchase accounts, personal work account etc. 

In cases of suspicious activity in your bank account, some bank's policies include declining suspicious transactions, and also have their fraud prevention teams contact you and investigate if the purchase was conducted with your consent. Also, whilst noticing unusual activities in your account, some banks also use the ‘freeze accounts’ option, which means that you are unable to use the account until they are assured that your account has not been subject to unauthorized access.

Further, immediately after you call the IT department, you need to log in online from a different source or computer and begin changing your passwords of banks, purchase accounts and so on. By doing so, you reduce the risk of data loss, financial damage, and intellectual property theft. Thus, firstly you need to secure your financial accounts, and then move to your email addresses and social media accounts.