‘Tis the season!

It’s this time of year when we are snowed in by a huge number of deals online or in stores. Black Friday, Cyber Monday, Christmas Sales, Boxing Day, Boxing Week, Holiday Shopping – flyers are snowing in our mailboxes. But with increased shopping activity everywhere there is an increased scammer activity that follows. That is why I thought to learn a bit about different types of phishing and how to recognize them. After all: knowledge is power.

We just went through a Month of Cybersecurity Awareness (October), but we keep on hearing about cybercrime affecting more and more people. The lack of personal protection spills into micro and small businesses and learning how to recognize a scam can protect not only you but your business (or your employer). Micro and small businesses are impacted much more by the losses caused by cybercrime simply because they don’t have huge resources the industry giants possess to deal with the fallout.

Among others phishing is the number one technique cyber criminals use to infiltrate your network to install malware/ ransomware or steal your data. It’s no longer the industry giants that suffer from cyber-attacks, it’s all of us. Because of that it would be most beneficial to learn what phishing is, and what forms of it are out there.

What is phishing? It is a form of an attack where a scammer contacts you using different means to trick you into sharing sensitive information. These are often generic messages that appear to come from a legitimate source, such as a courier company, your bank, your supplier, or your friend on social media claiming they have been hacked and need your help to login into their accounts.

How it works? A message is tailored to look like it comes from a legitimate source and then it is mass sent, using spoofing techniques, in hopes that some will take the bait. A victim is being hooked by an urgent request to take action to resolve the scary issue. It may be talking to a representative or clicking a link. In taking such action the victim is re-directed from a legitimate source to scammer’s fake version of it and all the information is being harvested to allow for the actual attack. It may be that the victim is asked to send back a screenshot of a message that was sent to them from their legitimate service provider. This screenshot often provides the scammer with means to login to victim’s account and change password, taking away the victim’s access to their own account (if a victim s using their cell phone number for additional source of authentication). Depending on circumstances this attack may take a form of accessing your bank, using your credit card, or using your personal information in order to commit other types of fraud, accessing other sensitive information can be used to gain access to your contact sphere and steal from them, use your credentials to steal information from your company or access its critical systems, allowing for other forms of cyber-attack (i.e., ransomware or impersonation).

So, what types of phishing are out there? Here are a few examples:

Spear phishing: Attack that targets you specifically (will include personal details about you gathered through, quite often, your and your friend’s social media accounts).

Whaling: a spear phishing attack directed at “big phish” – A CEO or other high ranking company executive who has access to more sensitive data in his/her organization.

SMiShing: an attack using SMS (text) – impersonating your friend, service provider etc. to request payments or offer updates.

Quishing: an attack using QR codes, usually done via email. QR code directs the victim to a malicious website (dangerous, because it may easily bypass a lot of email protection methods).

Vishing: voice phishing – all those pesky phone calls about your social security number being suspended or border services sending police to arrest you, claiming your computer is infected or a “bad” package was sent to you etc.

In one of my previous posts: How Not To Become A Phishing Victim I talked about how to recognize a phishing email.

More information about phishing in general can be found, for example, in August 2022 Government of Canada document from Canada Centre for Cyber Security titled: Don’t take the bait: Recognize and avoid phishing attacs – ITSAP.00.101

And trust your instinct and don’t engage when something does’t feel right. Grab your phone and call your contact to check and confirm.

If you have any more questions, or if you are looking for ways to protect your business from email phishing attacs that may cost your company as well as your clients a lot of money feel free to contact us.

Everyone does IT we make IT simple!