Hook, Line, & Sinker: Phishing Is A Dangerous Sport

 

All email users should be aware of phishing so they know how to avoid it. Phishing is the term used to describe the use of computers to try to get personal information from people that is then used to open accounts, make purchases, or send out spam emails using someone else's account- while looking like a reputable bank or entity.

 

Have you ever received an email that appeared to be from a bank, asking you to confirm your account details by clicking on a link and entering in personal information? This is a typical phishing attempt, and should absolutely be avoided. If you thought it was a valid message from your bank and filled it out; chances are your information would be caught by the “phishermen” and you'd end up the victim of identity theft.

 

It's important for individuals to recognize a phishing attempt so that they can avoid it; but it's just as important for businesses to recognize phishing as well. Consider what could happen if the person in charge of your organizations bank accounts and financial information mistakenly responded to one of these phishing attempts! Depending on the nature of the crime, it could result in thousands of email messages being sent from your organization's email address; or worse- your organization's funds could be wiped out in minutes from someone answering a few questions on a fake website designed to grab the pertinent information.

 

You might think you would recognize a fake website, but there are so many advanced techniques being used that often the fake website looks exactly like the original. There are ways to disguise the URL that appears in the web browser's address window; there are ways for phishing emails to address you by your name.

 

Some email programs are designed to block emails that are obviously phishing for details- but the criminal masterminds behind these crimes have learned how to get past most phishing filters simply by creating images out of their emails rather than sending text! The best way to prevent phishing attacks is to train individual's how to recognize them; and this should actually be part of your email training with all staff members.

 

To train people how to recognize and avoid phishing attempts, it's a good idea to start with a simple technique anyone can learn. When sent an email from an organization that you actually have accounts with or do business with; do not click on the links in the email, even if they appear to bring you to the organization's website. Instead, open your browser directly and type in the URL to the company yourself. You can then contact that company directly to see if they did in fact send out the suspicious email- chances are; they did not. Most companies will not attempt to get any account information from their clients via email because of the known phishing tactics.

 

While the majority of phishing takes place online using emails and/or fake websites designed to look like actual websites, there are some forms of phishing that actually happen over the phone. Be sure everyone in your organization is the aware of this as well- and train them to never give out sensitive information or account information over the phone, because honestly, how do you know who has called you? Simply take down the details of who is supposedly calling and from what company, and tell them you will call them back. Hang up, and call the company directly using the phone number on your statements, a business card of someone who works at the company that you've dealt with before, or from the phone book.