- You open up your inbox and you see this.
By all appearances,
it looks like PayPal sent this email.
There's a logo, lots of links for questions and resources,
the sender address
is even from an official looking PayPal account.
But you don't have a PayPal account
or at least you haven't used it recently
for anything involving crypto.
What is happening here?
This is a classic example
of the online scam called phishing.
You know what they say:
You can lead a fish to water, but you can't make them click?
Today, I'll dive into the depths
and talk about what is phishing,
the different types of phishing out there,
and how to catch a phish.
Phishing is a type of online scam
in which con artists cast a wide digital net.
They craft or generate decoy messages
and send them out to hundreds,
sometimes thousands of people.
Often, these decoy messages pose as an official source
like our PayPal example or an individual.
Sometimes it's even someone you know.
The message inside prompts you
with some kind of charge or prize or emotional lure.
Click on the link inside and enter your info,
you've taken the bait.
After, you're usually greeted with a dead end
and the scammer has what they need:
logins, passwords, passcodes, IP addresses, bank info,
you name it.
They may use that data to steal your money, identity,
or as a lead for scamming more people.
Unfortunately, there are plenty of phishing scams
in the sea.
While email examples like this are typical,
phishing attacks have become smarter
and migrated to other waters.
Malware is a catch-all term
for malicious software that disrupts your device
or gives scammers access to it.
Without getting too technical,
it's just really bad stuff.
And malware phishing takes two bad tastes
that taste bad together.
It's basically email phishing
with something really nasty hidden in an attachment.
Common subject lines may mention an invoice or a bill,
a shipping order for example.
If you come across something like this,
double check the sender address
and don't click on the attachment.
Instead of sending out decoy messages
to thousands of people,
spear phishing is a highly targeted phishing attack.
With a little knowledge of your contacts or online activity,
a phisher can craft a message that feels really real.
Cornell University has a huge list of examples
with messages like this.
This.
And this.
I'll drop a link to that site
if you wanna see all 59 pages of examples,
but it's pretty wild how clever these messages are.
Most on the list add a link
before the full message is conveyed,
making the target click
before they even know what they're signing up for.
All of these feel like plausible emails that would land
in a student or faculty inbox,
but when phishing goes after bigger game,
those with privileged information, lots of money,
that's called whaling.
One famous victim of this is John Podesta,
Hillary Clinton's 2016 campaign chairman.
This email was sent to staffers' inboxes
with the subject line somebody has your password
and went on to tell Podesta that that someone
was located in the Ukraine.
The email prompted him to change his password
and snagged both his old and new passwords in the process.
I bring this up not to rehash old political stories,
but to use it as an example.
Even people in high positions can fall for this
because sometimes scammers make them feel really real,
especially when they're targeted towards you.
While they may sound like the latest TikTok dance moves,
smishing and vishing are types of phishing attacks.
They have similar strategies, just different platforms.
Smishing or SMS phishing happens via text.
Maybe you've received messages like this
from a mysterious number.
Most out there feel really obvious,
but in recent years,
I've seen some release sly strategies.
Scammers may pose as big companies like Amazon
or nonprofits looking for survey respondents.
Vishing or voice phishing happens over the phone.
You may get a strange number calling you
or a weird voicemail.
They may pose as your bank, an IRS agent,
or other official sounding entity.
They may ask for your social security number
or bank account number to help clear something up,
but don't trust it.
With phishing attacks growing smarter and smarter,
how do you catch one before you take the bait?
Here are some tips.
The one thing you should learn from this video
is to avoid clicking links in emails
just as a general practice.
Unless you're expecting something from someone you trust,
be skeptical about your inbox.
When you see messages about an invoice,
deal, charge, or whatever,
look it up in your browser
or contact the sender another way.
Contact your bank, PayPal,
or anyone's suspicious emails come from
before clicking on anything.
And if it turns out to be a phony email,
you can report it to the FTC
or the Anti-Phishing Working Group.
I'll drop links below to those.
Don't worry, they're real.
Okay, we're all human
and phishing attacks are designed to appeal to humans.
If you do click on a link
from a business, bank, or whatever, proceed with caution.
So here's an easy trick.
Whatever your browser of choice,
you should have a little lock icon next to the URL
of a given site.
When your browser trusts the website, that lock is closed.
When it doesn't, it's unlocked.
If you do click a link in a text, email,
or on social media that feels iffy, check that lock.
This may not be totally foolproof,
but it's a really good litmus test for checking new links.
Okay, this is just a good habit to get into,
but if a sneaky phishing attack got you,
you'll want to know about it ASAP.
So get in the habit
of checking your bank statements regularly.
When you see unusual charges, report them.
Waiting too long will make it harder to fight those charges
because those phishers have just swam away.
If it talks like a fish, comes out of the blue like a fish,
and prompts you to click like a fish,
it's probably a scam.
And although our technology changes
a little more every year,
so do the black hats with it.
We've got resources on safewise.com
if you want to learn more about phishing
and other tips for staying safe online.
Or check out our next video with recommendations
for building your own cybersecurity toolkit.
Thanks for watching and stay safe.
(bright music)