Spring and summer are phishing season!
Actually, any time is phishing time as hackers continue to improve and expand their efforts to get your information and money.
Phishing is a type of social engineering where emails or websites try to get personal information by pretending to be a trustworthy source. And who would you trust more than someone in the payroll department at your company?
Attackers like responsive contacts. If they can get you to respond to their message, they can gain valuable information and use it against you later.
Consider that someone in your company receives an email from what looks like a new employee saying they’d like to change their direct deposit information. That person replies to the message that they aren’t the ones handling payroll and that the email should go to the payroll department (and offers the email address).
Now the bad guys have some very useful information thanks to one simple reply. Not only do they know that the original recipient of their message is an actual employee, they also now know the email address of the payroll department.
The next thing you know, employees are getting emails from the payroll department (but not really from the payroll department) asking for the new direct deposit information (so they can empty your bank account) or for your social security number (because they said they had entered yours wrong) or other personal information that can be used to impersonate you, steal your money or ruin your credit… among other things.
Here are a few common indicators of phishing you should always be looking out for:
Generic greetings and signatures: Not knowing your name (Dear Customer) and not having a complete signature (no phone number or company name with logo) should make you very skeptical of the sender
Suspicious or unknown email address: Make sure you look closely at the sender’s email address to see if the name is misspelled or missing characters. Mircosoft isn’t the same as Microsoft.
Hover over hyperlinks to find spoofed addresses: Attackers may use poor spelling, link shortening and other tricks to hide the real destination of a hyperlink. Does the link address match the text link? Do you feel lucky?
Poor spelling and a bad layout are often the best clues to a bad email: Even if it isn’t from a hacker, poor spelling and a bad layout is a problem. When it hides malicious content, it’s worse.
Attachments spell trouble: Don’t open unsolicited attachment files – ever. Even if you asked for the file, check with the source to make sure the file is from them and not a trick to get you to download malware on your computer. If you get a file called invoice.html, never open it. If it’s a real invoice, the supplier will find a way to get it to you.
In summary, be really paranoid and don’t click on links and don’t open attachments and only reply to emails that have been determined to be legitimate. Besides, one should think a moment before responding. That’s what my boss says, anyway.
Mike, the IT guy
NOOBEH cloud tech
