How to avoid phishing emails

What is a phishing attack and how do they work?

When a person opens a phishing email, what will greet you is impossible to predict. The message the user sees will have been manipulated to pose as legitimate communication. This could mean appearing like it has been sent from a trusted colleague, client or supplier.

A phishing email will aim to dupe the recipient into revealing sensitive information or unintentionally downloading malicious software. By clicking on a link or opening a malicious attachment, personal or company information can become compromised such as login credentials (usernames and passwords) or financial informational (bank card numbers).

Phishing attacks were the most common form of cyber-attack last year; reported incidents more than doubled from 114,702 in 2019 to 241,324 in 2020. Thankfully, due to their increased frequency, there is more awareness around phishing scams and how to avoid them. With the right cyber security strategy, your organisation can protect its IT infrastructure from phishing emails.

Types of phishing attacks:

• Clone phishing
• Whaling/ CEO fraud
• BEC (Business Email Compromise)

How to stop phishing attacks

Here are 5 steps that your business can take to avoid phishing emails.

1. Understand what a phishing email looks like
2. Avoid clicking unknown links or attachments
3. Change passwords regularly
4. Don’t give out personal information
5. Implement cyber security features
   
   

1. Understand what a phishing email looks like

Cyber criminals are developing new methods all the time, including new ways for phishing emails to manipulate the recipient. As phishing emails have a similar end goal, they have shared common traits, which makes it simpler to implement cyber security protections compared to other potential threats. A smart way to protect against phishing emails is to monitor the latest methods being used to identify the risks they pose.
Computer users need to understand what phishing emails are, the threat they possess, and how to avoid falling victim to them. Regular security awareness training reduces the risk of a phishing attack being successful.

Things to look out for include:

• Misspelled domain names (e.g. www.blukube.tec)
• Public email domains (e.g. @gmail or @hotmail)
• Grammatical and/ or spelling mistakes
• Suspicious attachments or links
• The email tone conveys threats or enticements to create a sense of urgency
• Non-personalised greeting (e.g. Dear Customer)
• The contact details don’t match the registered company details

You can learn more about phishing attacks here.

2. Avoid clicking unknown links or opening attachments

The biggest way phishing emails dupe recipients is by convincing them to click a link or opening a suspicious attachment. Doing so may download malware, which could be any form of malicious software that could cause massive damage to your IT infrastructure. Even if an email is from a sender you recognise, don’t click the link straight away. Carry out the necessary checks first.

One way phishing emails have become more sophisticated is by using the recipient’s real name. A cyber security best practice is to hover over the link to see where it’s directing you and if you’re in doubt, go to the site you want to directly. Always remain vigilant and proceed with caution before clicking a link or opening an attachment that you receive on email.

3. Change passwords regularly

One way phishing emails target the recipient is by attempting to trick them into revealing confidential information such as usernames or passwords. Passwords should never be shared if requested on email to counter this tactic.

It’s also best practice to monitor who has access to systems that you use so that you can identify any unusual activity and quickly spot if a password has been leaked. Changing passwords regularly adds an extra layer of cyber security protection against all forms of cyber-attacks, not only phishing emails.

4. Don’t give out personal information

It’s not only passwords that shouldn’t be shared over email, users shouldn’t give out any personal information.

A phishing email may provide a link that takes you to a shopping website. From there, you enter your card details and make a purchase. A confirmation page appears and everything seems ordinary. In reality, while appearing trustworthy and legitimate, the link directed you to a fake site created to steal card details.

This scenario can be avoided by not clicking the link, but you also shouldn’t share sensitive information (such as financial information) if requested by email. Always verify if a request is legitimate. For example, call the company you believe is asking for information to check if the phishing email is masquerading as a message from a trustworthy organisation. This is important for safeguarding any financial and personal information.

5. Implement Cyber Security Features

Firewalls are a buffer between your IT infrastructure and malware. They act as the last line of defence against malicious actors causing harm to your computer systems. If a link is clicked or a file downloaded that contains malware, firewalls reduce the risk they pose. There are two types: desktop firewalls, which is software, and network firewalls, which is hardware. Both cyber security features complement each other to form effective protection against cyber-attacks.

Other cyber security features that protect against phishing scams include anti-virus software. This measure ensures viruses can’t carry out their intended purpose. Email protection software uses machine learning to develop an understanding of phishing emails so they can identify them and notify the recipient. They may block emails being received or apply a warning message to urge caution to the computer user.

What threat do phishing emails pose to your business?

Over the years, phishing attacks have become more and more common. Typically, they’ve been targeted at individuals and smaller companies but in the last few years there has been a significant rise in the number of hackers using phishing attack tactics, targeting organisations who do not view themselves as vulnerable to this type of cyber-attack.

What is the threat to your business? As phishing attacks are a form of social engineering, they trick people into doing something that they would not normally do. The hacker is trying to get the recipient to take the bait, in the form of an attachment or embedded link, which then installs malware on the user’s computer or mobile device. This can mean a company’s IT infrastructure is in danger as malware could infiltrate the system, or mean that login credentials, sensitive information or financial information is accessed.

How can your business protect itself against phishing attacks?

Filter it

The best, and first, way to defend your organisation against a phishing attack is to ensure that your anti-virus, anti-spyware, and any anti-malware applications are maintained and up-to-date at all times, we offer a cyber security service where we monitor and eliminate potential cyber-attacks before they do any harm.

Talk to your employees

Educating all your employees, from the senior leadership team to the most junior employee, is crucial. After all, it takes a human being to read the email and click on the link for the malware to be installed. There is a growing trend of hackers researching their targets and targeting those with financial authority so it is important that those in your organisation who have banking credentials, etc. are particularly aware of the possibility of receiving phishing emails.

Monitor it

Implement monitoring systems that can highlight any suspect activity; this could include potential exfiltration of data to remote hosts, privileged user access or suspicious connections. By doing so you’ll increase the chances of stopping the attack before it.

Bluecube Cyber Security Protections

Unfortunately, phishing works; that’s why its such a popular form of cyber-attacking.

Phishing emails pose a big risk to many computer users and organisations, of all sizes. They allow cyber criminals to steal money, access sensitive data, and damage IT systems. Cyber security protection against phishing emails doesn’t have to be complicated, at Bluecube, our expert team helps you to install protections that safeguard against phishing scams. We offer a range of services that can help defend your systems from this threat and many others, as we have software which will indicate if a "communication" is potentially phishing.

Learn how to protect against phishing scams, get in touch with Bluecube by giving our team a call on 0845 257 8010, drop us an email (enquiries@bluecube.tech) or fill in our online contact form, and we’ll be in touch.