Phishing Scams: How to Spot Them and Protect Your Information

​Phishing is a type of online fraud that involves tricking users into divulging sensitive information such as passwords, usernames, or credit card numbers. Phishing is a cybercrime in which a person(s) or organisation is contacted via email by a cybercriminal posing as a legitimate cause with the goal of gaining personal information or infecting the machines of victims with harmful malware.
​
Cybercriminals use a variety of tactics to carry out phishing attacks, including social engineering, email spoofing, and website spoofing. In this blog post, we'll discuss how to recognise phishing attempts and avoid falling prey to them.

1. Be cautious of unexpected emails or messages
hishing attacks often take the form of emails or messages from what appears to be a legitimate source such as a bank or a well-known company. Be cautious of unexpected emails or messages, especially if they contain urgent language or ask for personal information.

2. Verify the sender’s email address
When you receive an email that appears to be from a legitimate source, it's important to verify the sender's email address. Phishing emails often use spoofed email addresses that may appear to be from a trusted source, but are actually from a cybercriminal attempting to trick you into divulging sensitive information.

Companies will typically use their domain name after the ‘@’ symbol, such as abc@apple.com. In order to obtain such an email address, you will have to own the domain name, or an authorised person needs to create one for you, meaning that scammers cannot just create email addresses with the same name as organisations – they may instead add extra words. For example, instead of [email protected], scammers will use email addresses like [email protected]
Although scammers cannot create an exact replica of an organisation’s email address, they can edit the name of their email account to be anything they want. 

Some email services, like Outlook and Gmail, allow you to hover over the sender’s name. Doing so will allow you to identify the email address of the sender. 

This is what it looks like when you hover over the name of the sender

These changes can be really subtle and easily to miss if you just quickly glance at the name of the sender. Which is why it is important to pay close attention to email addresses.
By verifying the sender's email address, you can avoid falling prey to these types of attacks and help protect your sensitive information.

3. Don’t click on suspicious links
Phishing emails often contain links that direct you to a fake website designed to look like a legitimate one. These fake websites are designed to trick you into entering your personal information.

4. Be wary of attachments
Scammers will not only try and direct you to malicious websites, but they will also try to infect your devices with malware. They do this through email attachments, by simply clicking on the attachment, malicious code can run that will compromise your device. Almost all phishing emails will come with an attachment of some sorts.

5. Keep your browser and antivirus software up-to-date
Keeping your browser and antivirus software up-to-date is crucial in protecting yourself against phishing attacks. Phishing scams often exploit vulnerabilities in outdated software, so keeping your software up-to-date helps protect you from these types of attacks.

If you do not have an antivirus software installed on your device, consider Watchdog Support. Watchdog is a computer support software, that not only acts an anti-virus but as a virtual ‘best-friend’ for your computer that will automatically seek out problems and correct them. Try Watchdog out for free with a 30-day trial. 

6. Use two-factor authentication
Two-factor authentication adds an extra layer of security to your mail account. Even if a hacker manages to obtain your password, they won't be able to access your account without the second factor.
Two-factor authentication options include biometric identification, such as facial recognition or fingerprint scanning, or a security code sent to your mobile device.

You can learn more about securing your digital life and the importance of two-factor authentication in one of our other blog posts.

7.  Be wary of requests for personal information
Legitimate organisations, such as banks or government agencies, will never ask you to provide personal information such as your National Insurance number or credit card details via email or phone.

What happens if I am victim to a phishing email?
If you fall for a phishing email and disclose your sensitive information, the consequences can be severe. Cybercriminals can use your information to gain access to your online accounts, steal your identity, and make fraudulent purchases using your credit card or bank account.

They can also sell your information on the dark web to other cybercriminals, who can use it for their own malicious purposes. In addition, some phishing emails contain malware, which can infect your computer or mobile device and steal sensitive information like login credentials or financial data.

For businesses, phishing emails are not only targeting the businesses; scammers will also try and gain access to your customer database. If the attacker is able to access the customer database of a business, this is considered a data breach under UK GDPR with the repercussions being a maximum fine of £17.5 million or 4% of annual global turnover – whichever is greater – for infringements.

The potential harm that can result from falling for a phishing email makes it crucial to be cautious and take steps to protect your information.

How Elite PCs can help you
Recently, Elite PCs was contacted by an organisation that had fallen victim to a phishing attack. The goal of the attacker, in this instance, was to infect this companies’ computer in hopes of gaining their customer database and then targeting their customer base with phishing emails, aiming to gain a financial transaction from this companies’ customers.

This attack started with a simple click on a link in an innocent looking email, with that the attack on the company had taken place. Malware was instantly downloaded onto their machines without their knowledge.

With the malware now infecting their machines, the attacker was now able to access all of the data on their computers, everything from employee email addresses to customer information and emails addresses.

With knowledge of what both employee and customer email addresses look like, the attacker was now able to create a legitimate looking email address by copying the company’s email address. The attacker also created a folder where all email exchanges between themselves and customers would be stored, rather than the emails being sent to the inbox, this is how the attacker remained undetected.

The attacker began sending out phishing emails with 14 customers being targeted on the first day of the attack. Luckily, the infection was discovered after a customer contacted the company concerned over an email that they had received from said company.
​
The company, having no clue what the customer was talking about, discovered the folder that the attacker was sending emails to, and immediately contacted Elite PCs.

Elite PCs then spent a weekend installing Enterprise Bitdefender (which is a part of the Watchdog Support package) and 4 other programs designed to scan for specific types of infections on all of the company’s machines, in order to check for infections and do first scans.

The following 3 weeks afterwards, Elite PCs conducted daily scans to clean anything that came in. The company decided that Watchdog Support would help bolster their computer security and give them computing peace-of-mind.

If you are concerned that you have also fallen victim to a phishing scam, Elite PCs can help you remove any malware that may have infected your computer as a result of a phishing scam.

You will need to act fast if you have fallen victim to a phishing scam, contact us at 01244 344366, or visit us at 44 Nicholas Street, CH1 2NX, Chester.
 
Conclusion
In conclusion, phishing attacks are a serious threat to your online security. By following these tips and being cautious of unexpected emails or messages, you can help protect yourself from these types of attacks. Remember, if something seems too good to be true or too urgent, it's best to double-check its legitimacy before responding or clicking any links.
 
Thanks for reading, and stay vigilant!