Phishing email dangers lie ahead.

Phishing email dangers lie ahead.

Below are some hints and tips when handling phishy smelling emails of unknown origin.

Phishing email – What is it?

An email phishing attempt or attack is comprised of a malicious person emailing an unsuspecting user with a deceptive request for personal information under the guise of a legitimate organization or person.

Many times, blank emails may be sent before a phishing attack - as the method for validating the email addresses for further phishing attempts.

It may also involve questionable phone calls and social engineering attempts, as the attacker tries to gather more information about the target.

Phishing – The history:

Phishing and social engineering was initially exclusive to rogue hackers and small scale groups of technical people with similar data collection goals.

The early phishing was done on a one by one basis with goal of gaining access to systems or information capture. This quickly evolved into adding malicious files and malware to advance these attacks.

In recent years – the phishing process has advanced with automation simplified and scaled building out frameworks, toolkits, services and workflows.

These workflows often route unsuspecting internet user's around the globe to fake login websites and malware hosts for data collection.

In some cases – teams of bad actors combine efforts leveraging modern techniques to trick software and people into communicating with malicious networks.

Today – Phishing is a global business industry netting billions of dollars profit annually.

Phishing vs. Spam – Aren’t they the same?

Phishing (noun): A scam in which an email user is duped into revealing personal or confidential information which a scammer can use illicitly. Phishing is a targeted method used for malicious activity – high risk.

Spam (noun): Irrelevant or inappropriate messages sent on the internet to large number of recipients. Spam is simply unwanted email – low risk.

Phishing – Examples:

A questionable email sent from a public or unknown email address, often sent from free email providers.

Receipt of a blank email that with no links, attachments, or any real information.

An email message with gaps in the information leading you to want to respond to the sender with questions.

An unsolicited email from an unknown person trying to convince you to provide information about family members, friends, or co-workers. The person may reference the names of other people you know in an attempt to gain your trust.

Hints and Tips – What you can do!

As an email user you must stay vigilant and aware if something seems too good to be true or if it is just plain odd and out of the ordinary. It should be examined with caution.

Never give out personal or financial information unless you have validated the person requesting the details. This includes email, phone, or any other questionable media or communication path.

Do not share passwords or freely give them up. There is typically no reason anyone would need to know your password.

Do not have the same password for multiple accounts. Example – If your one account, used to register for contests has the same password as your second account, this could lead to cross account compromise. Then if an person gets access to your one account – they could potentially get access to your second account.

If you want to attempt to track the email's sending server, the email header section in the original message often contains the email's point of origin(IP address).

If something does happen, simply reach out for help – from your email or messaging service provider.

These online actors change tactics often to trick people daily – this activity distracts and impacts us all.

Remember – a quick response could help shut down an issue and protect others.