ZR Systems Blog

ZR Systems has been serving the Aiea area since 2006, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.
(adsbygoogle = window.adsbygoogle || []).push({});

Think Before You Click: Spotting a Phishing Attempt

Think Before You Click: Spotting a Phishing Attempt

We’ve all caught the obvious spam email, like the message that is clearly bogus, or the offer that is definitely too good to be true.

We’re going to confidently assume none of our readers are getting tricked by Nigerian Princes or getting roped into order virility drugs from an unsolicited email. The real threat comes from the more clever phishing attacks. Let’s take a look.

Give Me the Short Answer - What’s Phishing?

Phishing is where you get an email that looks like an actual legit email. The goal that a cybercriminal has is to trick you into giving them a password or access to an account (like to PayPal, Facebook, or your bank) or to get you to download malware.

The problem with phishing emails is how real they can seem. A phishing attempt for your PayPal information can look just like an everyday email from PayPal.

Even worse, often phishing emails try to sound urgent. They make you feel like you have to take action quickly, or that a bill is overdue, or that your password has been stolen. This can lower the user’s guard, and force them into a sticky situation.

How to Spot a Phishing Attack

Like I said, it’s not always going to be obvious when you get phished. Even careful, security-minded, technical people can fall victim because phishing is just as much of a psychological attack as it is a technical one.

Still, there are some practices you and your staff should use:

Always Use Strong, Unique Passwords

This can solve a lot of problems from the get-go. If your PayPal account gets hacked, and it uses the same password as your email or your bank account, then you may as well assume that your email and bank account are infiltrated too. Never use the same password across multiple sites.

Check the From Email Address in the Header

You’d expect emails from Facebook to come from , right? Well, if you get an email about your password or telling you to log into your account and it’s from , you’ll know something is up.

Cybercriminals will try to make it subtle. Amazon emails might come from or emails from PayPal might come from . It’s going to pay off to be skeptical, especially if the email is trying to get you to go somewhere and sign in, or submit sensitive information.

Don’t Just Open Attachments

This is nothing new, but most malware found on business networks still comes from email attachments, so it’s still a huge problem. If you didn’t request or expect an email attachment, don’t click on it. Scrutinize the email, or even reach out to the recipient to confirm that it is safe. I know it sounds silly, but being security-minded might build security-mindfulness habits in others too, so you could inadvertently save them from an issue if they follow your lead!

Look Before You Click

If the email has a link in it, hover your mouse over it to see where it is leading. Don’t click on it right away.

For example, if the email is about your PayPal account, check the domain for any obvious signs of danger. Here are some examples:

  • Paypal.com - This is safe. That’s PayPal’s domain name.
  • Paypal.com/activatecard - This is safe. It’s just a subpage on PayPal’s site.
  • Business.paypal.com - This is safe. A website can put letters and numbers before a dot in their domain name to lead to a specific area of their site. This is called a subdomain.
  • Business.paypal.com/retail - This is safe. This is a subpage on PayPal’s subdomain.
  • Paypal.com.activecard.net - Uh oh, this is sketchy. Notice the dot after the .com in PayPal’s domain? That means this domain is actually activecard.net, and it has the subdomain paypal.com. They are trying to trick you.
  • Paypal.com.activecardsecure.net/secure - This is still sketchy. The domain name is activecardsecure.net, and like the above example, they are trying to trick you because they made a subdomain called paypal.com. They are just driving you to a subpage that they called secure. This is pretty suspicious.
  • Paypal.com/activatecard.tinyurl.com/retail - This is really tricky! The hacker is using a URL shortening service called TinyURL. Notice how there is a .com later in the URL after PayPal’s domain? That means it’s not PayPal. Tread carefully!

Keep in mind, everyone handles their domains a little differently, but you can use this as a general rule of thumb. Don’t trust dots after the domain that you expect the link to be.

Training and Testing Go a Long Way!

Want help teaching your staff how to spot phishing emails? Be sure to reach out to the IT security experts at ZR Systems. We can help equip your company with solutions to mitigate and decrease phishing attempts, and help educate and test your employees to prepare them for when they are threatened by cybercriminals.

Comments

 
No comments yet
Already Registered? Login Here
Guest
Tuesday, 19 November 2019
If you'd like to register, please fill in the username, password and name fields.

Captcha Image

(adsbygoogle = window.adsbygoogle || []).push({});

Mobile? Grab this Article!

Qr Code

Tag Cloud

Security Tip of the Week Privacy Technology Best Practices Cloud Hosted Solutions Business Computing Microsoft Backup Windows 10 Hackers Network Security Office Software Business Email Computer Upgrade Hardware Workplace Tips Disaster Recovery IT Services Business Continuity Server Data Quick Tips Windows VoIP Efficiency Malware Network Ransomware Cybersecurity Alert Small Business Managed IT Services Employer-Employee Relationship Productivity Microsoft Office Outsourced IT Mobile Devices Save Money Hacking Internet Social Engineering Miscellaneous Business Management Operating System Remote Computing communications Managed IT Services Passwords Browser Collaboration Mobility Password Virtualization Windows 10 Productivity Facebook IT Support Communication Cloud Computing Health Managed Service Provider Phishing Data recovery Innovation Telephone Systems Data Backup User Tips Social Media Office 365 WiFi Risk Management Recovery Private Cloud Marketing Encryption Gmail Holiday Tech Support Networking Processor Smartphones Cybercrime Artificial Intelligence Bandwidth Best Practice Managed Service Office Tips Application Staff Education Spam Data Management IT Support Law Enforcement Data Breach Customer Relationship Management IT solutions Meetings Google HaaS DDoS Internet Exlporer Flexibility BDR Work/Life Balance Patch Management Smartphone Legal Current Events Customer Service Cables Infrastructure Entertainment Identity Theft Wireless Technology Transportation Windows 8 Internet exploMicrosoft Rootkit Mobile Device Entrepreneur Users Virtual Private Network Politics Credit Cards Bring Your Own Device Computers Tablet Wireless Paperless Office Advertising Vendor Management IT Infrastructure Network Congestion Lithium-ion battery Maintenance Remote Workers Keyboard Fraud Mobile Device Management Firewall SaaS Bloatware Business Technology Windows 7 Scalability Managed IT Service USB OneNote Two Factor Authentication Remote Monitoring Public Cloud Tools Website Android Windows Server 2008 R2 Black Market Notifications Shortcut Settings Managed Services Provider Wi-Fi Evernote Going Green Hybrid Cloud Assessment SharePoint Saving Money Biometric Security Applications Spam Blocking Vendor Compliance Troubleshooting Two-factor Authentication Electronic Medical Records Television Tablets eWaste Hard Drive Computing Infrastructure Business Intelligence Social WIndows 7 Retail Excel Servers Books Workers Government Save Time Public Computer Environment Phone System Data Storage Telephone System Techology Hard Drives Training Display Worker Commute Social Networking Shadow IT Big Data Managing Stress Cryptocurrency Files Employer Employee Relationship App Memory Consultant Manufacturing Help Desk Automobile Telecommuting Emergency Budget Mobile Computing Chrome Cryptomining User Error Hiring/Firing Distributed Denial of Service Best Available Cabling Avoiding Downtime Employee/Employer Relationship Remote Work VPN Fax Server Database End of Support Worker