“Phishing” is tricking users, usually by email, into providing personal data for malicious or fraudulent use. These attacks have a low level-of-effort and high rate-of-return. The attacks themselves are focused around convincing a recipient to click on a link or attachment or sending a password. Phishing emails frequently utilize subjects and content based around current events and other areas of interest in business, to increase likelihood of enticing a user to act. “Spear-Phishing” and “Whaling” are phishing attempts that have been especially crafted to target an even more specific group of individuals. Even if the email looks legitimate, beware! Attackers go through great lengths to trick you. They may be after your personal information or may install software on your computer without your knowledge to record every tap on the keyboard – including your usernames, passwords, and bank account numbers.
A Few Tips
The reason phishing and spear-phishing are so effective is that they target an individual directly. You are the last line of defense and practicing awareness is part of everyone's job. A few general tips to get staff started:
To find out where a link is really taking you, hover over it with your mouse pointer. If the URL that is displayed:
- Is only an IP address.
- Does not match the URL that is shown in the email content.
- Is long and confusing but includes a familiar term.
then it could mean that this is a phishing email.
Try hovering over the links below to see some examples.
Knowing how to see where a link is going to take you can help you identify phishing emails before you fall victim.
Additional tips on how to avoid being phished
General Information About Phishing
