How to Spot Phishing Scams & Protect Your Data

We believe education is one of the best defenses against cyber criminals.

With that in mind, we want to provide some valuable tips for spotting and avoiding one of the most popular scams/tactics cyber-criminals use against you: the Phishing Scam.

Email is essential to your business and every day communication. It is also one of the prime spaces hackers focus on to steal your information and sneak into your network.

This is because it is SO much easier to get a person to click on a link, input account info or download a corrupt file via an email scam than many other hacker strategies.

You’ve probably heard this but it’s true – “There’s one person in every office that will click on anything.”

Hopefully that person isn’t you!

But – with the information below, you’ll learn how to spot these scams and some strategies to avoid them altogether.

Phishing Scams 101

What are some of the Goals of Phishing Scams?

• Steal Sensitive Personal Info – Credit Card Info, Account Login Info, Personally Identifiable Information (SSN, Birth Date etc.)
• Gain control of your computer or network
• Install malware or other computer viruses

How do cyber-criminals convince you to fall for their plans?

• Deliver file attachments with harmful software enclosed – viruses/malware/keystroke loggers
• Trick you into clicking on bad websites that secretly infect your PC with viruses etc.
• Convincing you to give them username info and password info to desired accounts

Things you should look out for to spot and prevent Phishing Scams

• Make sure that the “reply to” email address matches the sent address
• Any message that creates a sense of urgency – especially regarding login info
• Any message that requests sensitive data
• Questionable links or links that don’t match the anticipated site/source
• Random social media messages asking you to click a link to see a video or receive specific info

Keep in mind and remember that legitimate companies won’t email you asking for passwords, sensitive info (social security numbers) or other sensitive data via email.

 Sample Phishing Scams Explained:

Office Example:

1. The ‘From’ email address is suspicious
2. ‘From’ and ‘Reply-To’ are different and both are suspicious again
3. When you hover over the ‘Restore Access’ button there is a link that doesn’t match any Microsoft destinations

PayPal Example:

1. Bad sender domain
2. Suspicious Subject & Content – generic name and sense of urgency to give up account info
3. Bad grammar
4. Suspicious link if you hover over the masked link.

Amazon Example:

1. Bad domain in ‘From’ section – management@mazoncanada.ca
2. Generic Greeting
3. Bad link redirect
4. Sense of Urgency in message to get your account info

Response Strategies/Protocols for suspected phishing emails:

In the office it is important to have conversations with employees and make sure everyone knows what to do if they suspect a bad email.

• We recommend alerting your IT partner or IT staff members of the issue.
• NEVER click any links you think are suspicious.
• If you are unsure of an email you can always contact the related company direct. For example, with respect to any of the above emails you can always go directly to their official page, grab contact info and call/contact support to confirm that the email is real.
• NEVER use contact info in a suspicious email to figure out whether it is real or not. Criminals put fake phone numbers and contact info in their messages so of course they will tell you that the email is real.
• Hold regular cyber security and data security training in your office to make sure employees are up to speed on the latest techniques/red flags.