How to protect you and your business

Be aware of the 5 common types of phishing attacks: protecting yourself and your business is key. It’s important to create systems that ensure you are secure and that your operations are stable. It is essential to be aware of the latest threats and have measures in place to safeguard against them.

We will be discussing five of the most common phishing attacks that occur in businesses and how to best protect your IT network against phishing attacks. 

First, let’s have a closer look at phishing attacks.  

What are phishing attacks? 

Phishing is a type of cyberattack whereby the hacker attempts to fraudulently obtain information, such as login details or money from their target. This tends to occur mainly through emails.

5 Common types of phishing attacks and how to protect your organisation: 

Here is an overview of five of the most frequent cyberattacks:

1. Bulk phishing is a malicious email campaign sent to an extensive collection of people with the purpose of exploiting unsuspecting victims. It typically involves fake logins posing as recognisable brands and requests for payments through email links or money transfers.

This approach is mostly seen as casting a wide net – by sending as many phishing emails as possible, and the probability of catching a few victims in the net is highly probable.

2. Spear phishing typically arrives via an email targeting a specific person within a company. This form of phishing plays on the targeted individual’s trust by exploiting weak security practices that a particular person could use and then targets the person/company with a ransom fee to release the information back to the user.

What to look out for in a spear phishing email:  

When it comes to avoiding spear phishing emails, it is essential to be aware of certain signs. Pay attention to any suspicious-looking sender addresses, unusual content or subject lines that appear out of the ordinary, and attachments that shouldn’t be there. Additionally, watch out for emails that don’t seem personalised and check if any links lead you elsewhere before clicking on them.

• Adding personalisation to emails makes them more persuasive. It encourages customers to make a decision, as customised messages demonstrate that you understand the recipient’s needs and interests.
• Contains authentic logos and branding – actual companies’ brand is correct within the email template 
• But, the outbound link clicks into the actual ‘fake brand’ website. 
• Pay attention to the sender’s name and email address: Example: Microsoft Support <info@micr0soft.12hh.com> 

(Look out for any odd numbers, underscores, and exclamations within the sender’s email address) this usually could be a sign of a false email address, indicating a potential spear phishing attempt.

3. Whaling phishing is a type of cyberattack that targets a company’s senior employees. A whaling attack usually asks the target to make a high-pressured decision. Or pretends to be a Senior Manager and pressurises a junior member of staff into performing an action that the cybercriminal can profit from.   

Type of whaling attack: 

Whaling is an increasingly common type of cyber attack. It specifically targets high-level executives and other individuals who have access to important information. Whaling attempts to acquire sensitive data, such as financial details from company executives. Here are a few types of whaling attacks:

• Phishing scams that involve wire transfers, also known as Invoice Fraud, are becoming increasingly popular. This type of scam involves convincing victims to send money via a wire transfer. It is often done by impersonating someone the victim knows or by sending fake invoices.

• Credential phishing can take many forms. Attackers will often attempt to get login credentials by asking the target to log in to a ‘fake’ account and thus gain access to information, or they may be more direct and ask for payment directly.

4. Vishing phishing is ‘voice phishing’, which usually occurs via a phone call. Commonly use Voice over IP (VoIP) technology from a scammer, pretending to be a company’s representative, who attempts to elicit personal information from the caller, such as credit card or login details.

5. Smishing phishing is very similar to phishing, however, the crimes are performed over text or messaging services like WhatsApp.  

How to protect your organisation from phishing?  

It is essential to be aware of the threat posed by this malicious activity and implement measures to mitigate it.

Educating employees: 

Education would be the most critical step to take; ultimately, human error is the most significant risk to a company’s data exposure – without the proper awareness, this can cause a lot of damage to any business.  

The Do Nots:  

• Do not leave your phone unattended in public places.
• If you ever find yourself in a situation where someone is pressuring you to make a payment or financial decision that needs to be made immediately, don’t give away your card security information, including your PIN, internet banking credentials, and card number. This applies regardless of whether it’s done over the phone, by email or through messaging.
• Click on any links or open attachments found in emails or text messages that you did not request.

Security features that can help eliminate the chances of getting phishing attacks:  

Protection against phishing schemes can be provided by a variety of security features. These features can aid in reducing the risk of falling victim to fraudulent emails and malicious code. They include monitoring of suspicious activity, advanced threat protection, anti-malware programs, and firewalls. All of these safeguards contribute to decreasing the possibility of getting hit by a phishing attempt.

• Setting up email filters: Use email solutions that have effective spam and junk mail filters.   

• Anti-virus software: Having an-up-to-date anti-virus software, will ensure against any malicious attacks on your IT network. 
• VPNs: If using public Wi-Fi to access sensitive information – having a VPN can encrypt your online data.

Get support today

Get in touch today or book an appointment for impartial help and advice – email hello@clairelogic.net or call us on 01865 989144