The sending and receiving of malicious emails is a cyber-threat that all businesses should be on the lookout. But, unfortunately, what most professionals know to be correct about phishing attacks, isn’t always the most accurate information out there.
Here are four things that might happen in a phishing attack that most people don’t realize to be true.
Internal processes might be known.
When it comes to phishing, the attack can play out in a variety of ways, and if you͛re lucky, it won͛t involve your internal processes. When this happens, it͛s challenging to determine the legitimacy of an email (if that thought even crosses your mind to being with). As soon as content references your specific processes and policies, it͛s hard to say that the email is fake.
Because of this, it͛s crucial to remember that even if an email mentions your company͛s internal procedures, there͛s still a chance the email might be malicious. You must take additional steps to determine the legitimacy of the content, especially if it asks you for any sensitive data.
A co-worker might be used.
Hackers and cybercriminals do their homework. They͛ll research your company and get familiar with your processes, as well as your coworkers. In other words, they͛ll figure out who works for your company, what position they have, and where they rank on the totem pole. Then, they͛ll use this information and bounce it off your internal processes – which is where things start to get scary.
To avoid being duped by someone pretending to be your coworker, you need to slow down and read over everything carefully. This means you need to make sure the request makes sense to the person – Would this person frequently ask you to do something of this nature?
If the answer to this question is ͚yes,͛ then next, you should make sure the address the email originates from is accurate. There isn’t much difference between XYZTech@xyztech.com and XYZTech@xytech.com. But again, to catch this difference, you͛ll need to read things over carefully.
Grammatically, the email might be perfect.
Online users have always been told that phishing emails are going to be grammatically incorrect. It͛ll read as it came from another country, and it͛ll be littered with misspellings and forgotten commas. However, this isn͛t always the case. In fact, this is far from the case.
More oft than not, a phishing email will look rather perfect. It won’t have grammatical errors, and it͛ll appear completely normal. In other words, don͛t bank your whole process of verifying emails based on grammar. It won’t work.
You won’t always be asked to download something.
Phishing attacks aren͛t always about corrupt links and malicious downloads. Sometimes, they͛ll ask for something, like financial data, personal records, or login credentials. Or they might even ask you to do something – send over a document, adjust client records, or change company data.
Again, you need to slow down at this point and analyze what it is you͛re being asked to do. Don’t rush into action just because you can. Verify the request and the sender before you ever do anything.
Cybercriminals are much smarter than most people think, and with so much information available on sites like Google and LinkedIn on just about any company, their tactics to infiltrate your network are becoming much more precise and strategic.
If words like cybersecurity and data breach keep you up at night, then give us a call today! Let’s schedule a private briefing with one of our expert security consultants to discuss your network.