We all think we’re amazing at spotting fake emails and would never be THAT person who takes the bait. How can anyone actually believe a foreign prince needs you to transfer his fortune?! However, statistically speaking, it proves the opposite with 83% of organizations falling victim to a phishing attack in 2022. Evidently, we can be fooled pretty easily. The good news is we can reduce the risk of clicking these bogus emails through education and mindful strategic behavior.
What Is a Phishing Link?
Clicking on a malicious link is a common but costly slip-up that can have serious consequences. Fortunately, these bogus emails can be recognized and avoided by learning how to identify a phishing email. Sounds intense, but don’t worry, it’s much easier than it sounds – let’s dive in.
We all know about spam emails, but phishing is a bit different. According to KnowBe4, phishing is the process of attempting to acquire sensitive information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity using bulk email which tries to evade spam filters.
How to Spot a Phishing Email
The most common indicator of a phishing attempt is unusual error-filled language that just doesn’t sound or look right. For example, an email with a lot of spelling or grammatical errors could be a phishing attempt. It might seem small but knowing how to spot a phishing email is the first step in preventing unsolicited access to your network and sensitive information.
There are other signs to be on the lookout for, such as:
- A sense of urgency in the email. Words like, “Now”, or “Immediately” are red flags.
- The sender’s email address on the surface looks like it’s from a legitimate organization. For example, it may look at first glance that it’s from your bank, but when you hover over the email address something looks iffy. It might be that the message is sent from a public email domain, like @gmail.com (no legitimate organization will send emails from a Gmail account btw), or the domain name is misspelled.
- Has an ambiguous greeting and doesn’t use your name, or if it does, your name is spelled wrong.
- Contains a link that when you hover over it with your mouse, the link goes to a different website other than the one the email content says.
Example of a Phishing Email
Below is an example of a phishing email regarding a fake Microsoft 365 account. In the second image, we’ve highlighted the key areas that help us to determine it’s a scam. The one on the left looks like it’s from your IT department regarding your Microsoft password. However, when we stop, look, and think, we see many inconsistencies and can identify that it’s likely an email from an imposter trying to get you to click on the link.
In the 2nd image, we see three red flags that help us determine the email is fake. Let’s review them together!
- ‘Dear user’ is used as a generic or impersonal greeting rather than addressing specifically to you. Other greetings could include ‘Dear valued member’, ‘Dear account holder’, ‘Dear customer’, etc.
- When hovering over the ‘Please click here’ bait, you’ll notice the link directs you to an unfamiliar webpage and not somewhere Microsoft related. If the webpage is legitimate it should begin with ‘https://’ or ‘http://’. You can also try copying and pasting the URL into a virus scanner webpage, like Virus Total, to find out if it’s malicious or the real deal.
- ‘Within 24 hours’ creates a sense of urgency for the reader. Do not trust emails that convey this feeling or invoke fear that if you don’t do what the sender is asking right now, something bad will happen.
So, You Received a Phishing Attempt, What Do You Do?
Immediately act. Don’t wait until after your meeting or the next day so that you reduce the duration and impact of an active attack. If a phishing email was sent to you, it’s possible it’s also been sent to other people in your organization in a targeted approach. Don’t open the email’s attachments or click on any of the links. Take the email and report it to your helpdesk if you have one. If your organization has hired BT Partners as your Managed IT Services team, report the email to us at help@btpartners.com. Reporting a phishing email help reduce the frequency of attacks as the information you give provides valuable insights into the fight against scammers. It also can reduce the amount of spam emails that make it past your email filter.
You can contact the sender directly if you’re unsure it’s a phishing attempt. In the above example, you would contact your IT department to verify if they, in fact, sent you the email and need you to reset your Microsoft password and why. If you discovered it’s a fake, double delete the email after it’s been reported. That means delete it and then delete it again from your Trash folder. This reduces the chance of the email that’s idling in your Trash folder from making its way back into yours or someone else’s email inbox by mistake. Don’t forward the email anywhere as this will increase the likelihood that someone else will fall victim and click one of the links or open one of the attachments.
In a perfect world, we would be on top of our game 24/7 and would know how to spot a phishing email immediately. Except, this is rarely the reality. We’re humans. Humans have bad days, deadlines, work, and family responsibilities and commitments that often distract us from the dangers that are sometimes right in front of us. We can easily click a malicious link or attachment without thinking. If this happens, what do you do? Prepare yourself by checking out our next blog on this topic. In it, we’ll discuss what to do if you click on a phishing link and the steps you and your organization should take to swiftly remedy the situation.
