What is phishing? How it works and how to stop it

Phishing emails are a method of trying to gather personal information, typically using disguised email as a weapon. The goal is to trick the email recipient into believing that the message is something they want or need — a request from their bank, for instance, or a note from someone in their company — and to click a link or download an attachment.

What really distinguishes phishing from other cyber attacks is the form the message takes. The attackers will impersonate as a trusted source of some kind, often a real or plausibly real person, or a company the victim does business with. It’s one of the oldest types of cyberattacks, one of the most widespread, and a technique that’s becoming increasingly sophisticated.

Traditional phishing: This is the most common type of phishing. The hacker pretends to be another person (someone the victim knows or a reliable company) to obtain either personal information or login credentials.

Malware-based phishing: In this type of attack, the hacker introduces some malware into the email or a link pointing to a malicious site. When the victim accesses, a piece of malware is automatically downloaded to his device. This type of attack is especially common for small and medium businesses because the software they use is not always update to the latest version.

Spear phishing: Unlike in the previous cases, this type of phishing attack is usually much more personalized. Hackers normally include some personal data in these emails, such as: the name of the victim, his role in the company or his phone number. The reason for this is to gain his confidence and, therefore, obtain the information they need to compromise the corporate network and access the confidential data they are looking for.

There are a number of steps you can take and mindsets you should get into that will keep you from becoming a phishing statistic, including:

• Always check the spelling of the URLs in email links before you click or enter sensitive information
• Watch out for URL redirects, where you’re subtly sent to a different website with identical design
• If you receive an email from a source you know but it seems suspicious, contact that source with a new email, rather than just hitting reply
• Don’t post personal data, like your birthday, vacation plans, or your address or phone number, publicly on social media

Using an email filter alone won’t guarantee that you don’t receive any malicious emails, but it certainly helps.

Filters have been developed to divert or neutralize phishing emails. The suspicious emails are sometimes placed in a special inbox or flagged and stripped of their attachments and links. Users or admins can then examine its contents more carefully.

Having up-to-date antivirus software isn’t just important to protect your business from phishing attacks, they’ll help protect from all sorts of dangerous threats. Some antivirus software even comes equipped with anti-phishing capabilities which will scan the attachments of emails to check whether they are dangerous or not.

Educating your employees is arguably the most important step in the whole process. Although you may recognize the signs of a fraudulent email, if your colleagues don’t then your network is at risk.

Ultimately, human error is the biggest risk to your company’s data integrity and without adequate training, your company is likely to remain one of the thousands that falls victim to phishing scams each year.

Let us help protect your business. Contact us today.

Follow Plow Networks: Twitter, LinkedIn, Facebook, and Instagram