Like A Fishing Net, Email Phishing Catches Our Emails

Have you ever gotten an email that seemed genuine but for some reason it did not look right? Maybe it was from Amazon asking you to update your account password, or what looks like a FedEx email for a package you did not order.

These are examples of phishing emails. Cybercriminals understand human psychology and that many times our curiosity gets the best of us and we click the links in an email we find suspicious.

This is one of the reasons why phishing emails are so common among cybercriminals who seek to steal information.

Someone once said that phishing emails are like a fisherman who casts his net in the sea using a bait to trick the fish into biting and get caught. The fisherman is also applying fish psychology, when a bait is used to trick the fish. Similarly, phishing emails use deception to trick us into thinking that we are opening a familiar or safe email, prompting us to click a fake link or respond with sensitive information that the cybercriminal seeks.

What Exactly is a Phishing Email?

Phishing emails are designed to resemble emails that you are either familiar with or would trust. For example, an email that resembles emails sent by the HR department at your job, or the social media platform that you may use, or even one that appears to be from a friend.

One characteristic that should get you thinking and becoming cautious is when they always try to create a sense of urgency or drama, prompting you to act quickly and click a link or reply, because they know that if you stop and think for a while, you will realize their trap. Never be too quick to click links, open attachments, or reply to emails with information unless you are sure, after investigating, that the email is legitimate.

Phishing emails are used by cybercriminals to steal information, login credentials and in some cases infect your computer with a malware that gives them access to search files or monitor your usage, to track your keystrokes to gather information like your passwords, credit card details, or other sensitive data.

What are some Dangers of Phishing Emails?

Phishing emails have been the result of the following:

• Identity theft: Cybercriminals ultimately want to use stolen information to create a false identity which they use to impersonate you.
• Loss of money: Following up on your stolen identity, cybercriminals then use it to impersonate you at banks and other financial institutions or even your friends and contacts through your social media accounts, manipulating them into sending money to whom they believe it you .
• Malware installed: Sometimes the cybercriminal may play the long game and only want to install a malware program to monitor you to get more information. Usually this happens when you may not be the true target and are only used to reach someone else. For example, the CEO or Accountant at your job.
• Data breaches: Another long game by the cybercriminal is data breaches. Having personal details of a lot of persons gives them opportunities to not only cause financial loss to many people but also blackmail them if they possess embarrassing or incrementing information.

How to Recognize Phishing Emails

Here are some types of phishing emails:

• Deceptive Phishing: Phishing emails that impersonate using malicious links or attachments geared to get you to click or download.

  • Example: You receive what looks like an email from your streaming service provider Netflix, stating that your subscription will be cancelled within 24 hours unless you click the “verify” link to update your payment method.
    

• Spear phishing: When you throw a spear, it goes in one direction. Similarly, spear phishing emails, target a specific person or organization. It can be done as part of a social engineering effort to get as much contact details and information about the person or organization, or it can be done after a social engineering effort to deliver a malware to a person or organization.

  • Example: You receive an email that looks like it is from the HR department asking you to confirm your personal information for a new insurance policy plan for staff members.
    

• Whaling or CEO Fraud: This is a type of spear phishing aimed at someone in senior management within an organization or someone of high status. For example, an executive or a celebrity. The cybercriminal would usually impersonate the high executive to trick subordinates, manipulating them to give out sensitive information.

  • Example: You are an accountant and you received what looks like to be an email from the CEO, instructing you to do an immediate wire transfer of a large sum of money to a new account.
    

• Business Email Compromise or BEC: This type of phishing email is very dangerous because it involves the cybercriminal using a real email account that was compromised through techniques, they used like spear phishing or stolen credentials. They then use the real email account to send fraudulent emails with instructions that the recipients would trust and follow.

  • Example: A cybercriminal compromised the email account of the IT department at your place of workplace and has sent a fraudulent email to everyone instructing them to “verify” their credentials or “re-register” their multi-factor authentication after clicking a malicious link that actually installs a keylogger to start saving everyone’s keystrokes as in an attempt to get credit card number, passwords and other sensitive information.
    

• Clone phishing: The cybercriminal intercepts an email and duplicates it then sends the duplicate fooling the recipient into believing it is a legitimate email. The duplicate email usually has changes made to it like malicious links added and the message altered to make then click the link or perform another task.

  • Example: You receive an email from a business client with whom you have done business with, in the past. The email contains an attached pdf invoice that looks real and the email states the attached invoice is an updated copy for you to download. Unknowing to you the business client’s email was intercepted by a cybercriminal who placed the infected attachment.
    

• Domain Spoofing: This technique is usually used after a social engineering campaign has been completed where the cybercriminal now has a list of email addresses that they can impersonate by registering similar looking domains. The cybercriminal hopes that the recipient of the email will not recognize slight differences in the domain’s spelling.

  • Example: You receive an email from Microsoft to update your payment information. The sender email address instead of looking like this [email protected] is [email protected].
    Can you see the difference in the 2nd email address?

• Smishing or SMS Phishing: The cybercriminal uses SMS to send fraudulent text messages to deceive recipients into clicking malicious links, disclosing sensitive information, or engaging in impersonation.
  • Example: You receive a text message from your bank with an alert saying a suspicious transaction was detected with a request for you to click a link to verify, or the cybercriminal who gained control of someone’s mobile number by doing an eSIM swap, sends SMS messages to impersonate the real owner of the mobile number.
    
• Vishing or Voice Phishing: The cybercriminal uses this method send fraudulent calls or voicemails to manipulate victims into giving sensitive information or gain unauthorized access.
  • Example: After a cybercriminal has successfully done an eSIM swap, they are able to make phone calls using the victim’s number to impersonate them. Vishing also happens when the cybercriminal impersonates an institution such as a bank to deceive account holders into giving sensitive in.
    

Conclusion

Phishing emails are very dangerous because they can disrupt our communication and trust when a cybercriminal is able to either intercept or impersonate emails allowing them to trick the recipient. Even with the best anti-phishing technology, having an awareness of what a phishing email is and understanding the signs can help to ward off threats and reducing the risk of identity theft. Always think before you click and be very cautious with emails, SMS, or voice calls that try creating a sense of urgency forcing us to act before thinking properly.

Be committed to educating yourself and others about these threats and consider implementing additional security measures like multi-factor authentication, spam filters, and implementing a DMARC policy can significantly reduce the risks from phishing emails.

Click this link If you would like to know howTo: Deploy DMARC on a $0 Budget.