Phishing Emails – How to Identify and Guard Yourself

• May 10 2024

Phishing Emails – How to Identify and Guard Yourself

If you have spent any amount of time on the net using emails to communicate either professionally or personally, it is highly likely that you have been a target of a phishing attack at some point or the other. Phishing is an extremely common type of cyberattack in our digital age where individuals using the net are victimised through emails, phone calls, WA or text messages, and other forms of digital communication.

Why it is so important to Understand and Protect Yourself from Phishing

Phishing is not a prank. It is a scam. Attackers use this form of social engineering to deceive unsuspecting individuals to part with sensitive information, including financial information or system login credentials and the like. Or, phishing may be used to install malware that may be ransomware. Phishing often uses advanced psychological manipulation and deception where the recipient trusts and falls into the attacker’s malicious desired action. Threat actors who masquerade as reputable and trusted entities may dupe their victims (users) by sending phishing emails with inserted links asking them to click on them or fake websites, download and instal malicious files, and give away personal and sensitive information, including financial details like debit and credit card particulars and bank transactions.

In this blog, we limit our scope to phishing emails, and how to identify and guard yourself from them.

Understanding Phishing Tactics

It is important to remember that whether a phishing campaign is hyper-targeted or sent across to as many victims as possible (mass phishing), it always involves a malicious motive and could begin with a seemingly innocent and harmless message. An attacker will conceal the email as one being sent from a legitimate – and even trusted - company. It could even be disguised as a brand you interact with often. It is evident that the more aspects of the message that mimic the real company, the more likely an unsuspecting user is likely to fall for it.

While attackers’ goals vary, the common aim is to steal personal information, credentials, or financial gains. An attack is facilitated by emphasising a sense of urgency in the message, which could threaten account block or suspension, monetary loss, or loss of the targeted user’s job. Unfortunately, users tricked into an attacker’s demands do not take the time to stop and consider if they seem reasonable and/or if the source is legitimate, let alone discuss the issue with someone who is knowledgeable. As mentioned earlier, often the victim’s personal image is threatened, so the reaction is to play into the attacker’s hands at once in order to save the situation.

Phishing is a fast-evolving crime and continually keeps adapting itself to bypass security filters and human detection. So, it becomes critical that organisations continually train staff to recognise and protect themselves from the latest phishing strategies. What makes this so important is that it only takes one person to fall for a phishing attack to incite a severe data breach that has huge ramifications all through the organisation.

That is why it’s one of the most critical threats to mitigate and also a serious one that requires awareness and training to defeat.

Also read: What is a Phishing Attack, Types of Phishing Attacks and Prevention Methods

Email Spoofing – What is it?

Email spoofing is a common technique used in spam and phishing attacks. Here, an email is sent to trick the user into thinking that it came from a person or entity they know or trust. In spoofing attacks, the sender (attacker) forges email headers so that the receiver’s (victim) software displays a trusted source’s email ID, which most users take at face value. If the receiver replies back to that address, it will either bounce back or be delivered to a completely unrelated and faked party.

Urgent Requests that are Not-so-urgent!

A classic phishing email example is the Urgent Request that has landed in your mailbox from an impersonated sender. A widely-used phishing scam, it is also termed Business Email Compromise (BEC) or CEO Fraud. Such attacks are spear phishing scams created to impersonate someone you know in an attempt to gain sensitive information, transfer funds immediately, or provide gift cards.  Urgent Requests may also, at times, be disguised as ‘Need Your Attention’ or ‘Quick Question’.

Suspicious Links and Attachments

When an email is received from an unknown or unfamiliar source with a suspicious link an attached file(s), or if the recipient did not expect or request to receive a link or file from the sender of the email, the link should be clicked and attachment opened with extreme caution. You should be immediately on your guard that it could be a phishing email. It is best that you do not open any emails with unexpected attachments or suspicious links.

Tips for Identifying and Guarding Against Phishing Emails

If something seems off, follow the steps underneath –

1. Double-check the email address, examine the email content, and hover over the sender’s name and any links before clicking. Check closely to make sure the email address is correct. Hover your mouse over the sender’s name for the entire email to display.  If you are on a mobile phone or touchscreen device, press and hold the link for the actual URL to pop up.  Never ever click on a link unless you are sure it goes to a URL you absolutely trust.
    
2. Follow up with the sender on your own. If you are not expecting it, if it seems from a suspicious sender, it makes sense to reject it. Or, follow up with the sender individually in a separate email to confirm.
    
3. Flag it. Report it as Spam. You may even block it to prevent such attacks in the future.

Remember, in order to protect yourself and others from falling victim to phishing emails, it is key to identify suspicious emails and keep in mind the signs to look out for. Scammers may keep improvising various tricks to deceive their victims, but there are some common red flags that you must keep in mind. These include suspicious links, poor-quality grammar and spelling, and urgent demands and requests.

Conversely, a professional and informative tone in an email is never a suspicious characteristic. In fact, it is a standard practice in most legitimate business emails that they should not raise any alarms. They are mostly informative and even helpful. Content that is not associated with suspicious emails is hugely different. Examples of non-suspicious content will usually provide relevant information, and offer helpful guidance, with clear details of the sender, company, or source in the message. It is important to remember that such legitimate emails often contain valuable and critical content that assists and informs the recipient.

So, it is a good idea to remain attentive to the communication that comes into your mailbox, as it may contain both suspicious email characteristics and non-suspicious content. Learn to distinguish the relevant from the phishing email for your own benefit.  You may also enhance your email security and protect yourself from potential scams through the right training and legal software for the same.