What do you think a fishing attack looks like?
This?
Or this?
Maybe… this?
Ugh, not quite.
In this instance, we’re spelling "fishing" with a PH,
and it’s one of the most common online scams around.
So what is it?
Say you receive an email from your bank.
They’re asking you to log in to your account and update your details -
they’ve even provided a handy link
that will take you straight to the relevant page. Great.
Except, that email isn’t from your bank...
It’s from me.
And I’ve set up a very convincing website that looks just like your bank’s site.
So when you click my link and follow the bank’s instructions,
what you’re actually doing is giving me all your login information,
and whatever personal or banking data I’ve asked for. Thanks!
These kinds of emails have become commonplace in recent years,
to the point that they’re a bit of a joke.
We’ve all laughed at the “Nigerian Prince wants to send me his fortune” email.
“It’s so obviously a scam! How does anyone fall for it?”
Well firstly - if it didn’t work at least some of the time, no one would do it.
But secondly, by making you believe that all phishing emails are that obvious,
those scammers have lulled you into a false sense of security,
meaning you’re much less likely to spot a better executed attempt.
In a 2015 study, 97% of people were unable to identify sophisticated phishing emails.
How many of those people thought they were too smart to be fooled?
Part of the problem is that many people don’t realise
how personalised phishing can be.
Targeted attacks are called ‘spear phishing’
and they’re geared towards you.
Usually the “phishers” will have some prior information on you,
taken from social media or online public records.
They use this to tailor an email which seems too specific to be a generic scam,
and so is far more believable, and likely to yield results.
And scammers know this - in a review of over half a million mailboxes
it was found that 77% of spear phishing attacks targeted ten people or less.
More alarmingly 33% targeted just one.
So what does one of these look like?
Well, say your colleague has gone on holiday to Mexico.
You know he’s in Mexico because you saw him check into the airport on Facebook.
A few days later, he sends you an email:
He’s really sorry to reach out -
his phone, wallet and passport have been stolen,
but fortunately he remembered your email address.
Could you possibly wire him some money, using this link?
Obviously he’ll pay you back, he’s just in a bit of a tight spot
and needs to pay the consulate for his new passport.
None of this is particularly far fetched or difficult to believe.
But all the same, it’s not true - this is a spear phishing attempt.
Your colleague’s Facebook privacy settings are wide open,
so his airport check-in was visible to the whole world
- including our scammer -
who only needed five minutes to google your colleague’s workplace,
find you and your email address, and then fire off a compelling sob-story.
But it doesn’t even need to be that specific -
how many people are going to question
a Google Calendar meeting invitation from their boss?
Just click here to RSVP, sign into “Google”, and as easy as that,
you’ve given away your login details.
So, aside from ignoring emergency emails from your friends,
and deleting anything your boss sends you without opening it,
what can you do to stay safe?
Firstly, when you get an email, check - really check -
that it is what it says it is.
Secondly, never click any links provided.
If someone wants you to log in, go to their website independently
and log in from there.
If you’re still unsure, find a legitimate number
and call the company involved to ask about the e-mail.
Customer security is a big deal
and they won’t be fazed by being asked questions like this.
Thirdly, if you absolutely have to follow a link,
triple check the url of the website that you’ve been sent to,
and make sure it matches up with where you login normally.
Just seeing a padlock is not enough.
There are all kinds of tricks to fool even those
with a deep understanding of URL schemas, so you need to exercise extreme caution.
Phishing attacks are called that for a reason -
a lot of the time, those behind them are just throwing out a line
and seeing who bites.
But by being aware of how these kinds of scams operate
and exercising vigilance, you’re making it far less likely
that you’ll be the one to take the bait.