Phishing, how to know it when you see it.
Hi, everyone.
Leo Notenboom here for Askleo.com, this is one of those very common things we
talk about a lot and a skill we really hope everyone
develops, but it's not always obvious exactly what that skill entails.
Here's today's question.
"I've received an email from Microsoft
asking for billing details and threatening the end of my Outlook.com account.
Contacting Microsoft resulted in referrals to a support alias, but no answer.
Is this a problem or a forgery?"
Well, absolutely, you are very right to be suspicious, this absolutely sounds like
a fake email, something that we would call a phishing expedition.
Phishing, as it turns out, is the number one way
that accounts are being compromised and breaches are happening.
Ransomware, for example,
is more often than not the result of someone falling
for a phishing attempt and then installing malware on their machine as a result.
So what is phishing?
Well, phishing is like phishing.
It's like phishing for fish. Right.
You have something that the hackers want.
If you bite on their hook,
then they can access and gain access to something that they shouldn't be
at your account, your computer or your something else.
It's an email message trying to trick you into taking some action by fooling you
into thinking that the message is authentic when it is not.
There are three basic scenarios I want
to show you, the first one here on the screen.
Here's the article we're actually talking
about right now, if we scroll down, there's an example in this article where
I've got a link to eBay.Com, at least it looks like eBay.com.
If you take your mouse and hover over it,
you'll see down in the lower left hand corner, it's not eBay.com at all.
In fact, it's very benign site, I happen to think.
But it doesn't necessarily have to be
that way because of the way that HTML email and HTML Web pages can be encoded.
It is very possible for a link to be
displayed one way and actually go somewhere else.
There are actually legitimate reasons for this to happen,
but there are also illegitimate reasons, reasons like phishing that can cause you
to click on something and land use somewhere else.
So when you hover your mouse over a link
like this, it's important to realize what it is you're looking for.
The destination should match what you expect.
If it says eBay, eBay, dot hacker dot com is not correct.
It should be eBay.com.
The destination like eBay.com should be a name, not a number.
If it's a number, then it's probably not legitimate.
It's also fairly uncommon for them to still be doing this, but it happens.
And finally, the destination these days should absolutely be secure.
There's no reason for any Web site
that hackers or phishers are interested in not to be a secure site.
If it takes you somewhere that is not secure, stop.
Now, the second common attempt at phishing
is what I'll call the misleading attachment.
We've all seen these.
I'm sure the more common ones are shipping companies saying, hey,
you've got a package, we've got a package waiting for you.
We need you to fill out this form.
Well, you download the form.
It's not a form at all.
It's malicious attachment.
It installs malware on your machine and all of a sudden you're compromised.
Don't fall for that.
Always, always, always be skeptical about what it is these emails are asking you
to do, especially if they claim that what you need is in a document that's attached
that you need to download and unzip or view. Lately
it's also very common for these to be
stored in places like Dropbox, Google Drive, one drive and more.
So even if it's a link to a Web site
that is a file sharing site, be extra cautious.
As always, don't download and open
attachments if you're not 100 percent certain they're legitimate.
Now, the third approach is I'll use your example.
It's the misleading threat of closure where what they're doing is they're asking
you to reply with your account credentials, including your password.
Well, you've just handed your password over to a stranger. Accounts
legitimate services will never, ever ask you for your password via email.
The only time you'll need to enter a password is when you yourself are
signing in or you are confirming your identity with that service you've already
signed into, you are never going to have to send your
password to anybody else via email, in messenger or anything.
Same goes for Two-Factor authentication codes, by the way.
So the concern that a lot of people express with all of these different
approaches to phishing is well, but what if there really is an issue?
What if my account really is being threatened with closure?
What if I really do need to pick up a package and fill out some paperwork?
The answer's pretty simple, really.
Step one, ignore the mail, delete it, get rid of it.
Just make it go away,
then go visit the site or service that is referenced in that email by name yourself.
So if it's about eBay.com,
go to your browser and type in eBay.com.
Don't click on a link.
Type the address in yourself.
Same thing for PayPal, same thing for your bank,
same thing for Microsoft, same thing for your email account.
If there's an issue, if there's something you need to pay
attention to, it will be there as soon as you log in.
If the service has a messaging service, you may have a message in the service.
If the concern is more urgent, you may get a pop up message or a banner
that says, hey, there's something you need to take care of.
But the fact that there isn't
probably means what you were facing was a phishing email.
There was no package.
There was no closure threatened.
It was all somebody trying to get your
account credentials if you're still uncertain,
if you still aren't sure that going to the Web site manually
clicking on nothing but typing in the domain itself by yourself manually
doesn't reassure you that there isn't an issue.
Give them a call,
don't Google for a support number, those are often misleading as well.
Instead, go to that website, the UPS.com or the PayPal.com or
the eBay.com or whatever it is, and find the phone number on that website.
You can call to get a customer service
representative, ask them what the status of your account really is.
Once again, if there's no message for you when you sign in.
Ninety nine times out of 100, there's nothing to worry about.
You can safely ignore that phishing email.
Hopefully that's giving you some things to look for when you're scanning through
your email deciding what's legitimate and what's not for related links,
for updates and comments and more, visit Askleo.com one six four nine one.
I'm Leo Notenboom.
This is Askleo.com.Thanks for watching.