Phishing is a cybercrime in which a target or targets are contacted by email, telephone or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords. The information is then used to access important accounts and can result in identity theft and financial loss.
Phishing is the most common cybercrime in recent times, and it has become so common because sometimes it could be hard for people to really identify that the email or text message they get is not from the original or legitimate institution. Phishing messages are designed to look genuine, and often copy the format used by the organization the scammer is pretending to represent, including their branding and logo. They will take you to a fake website that looks like the real deal but has a slightly different address. For example, if the legitimate site is ‘www.fidelitybank.ng’, the scammer may use an address like ‘www.fideiltybank.ng’. Notice there are not the same.
There are so many types of phishing attacks which include email phishing, spear phishing, link manipulation, fake websites, CEO fraud, content injection, session hijacking, malware, mobile phishing, voice phishing, man in the middle ware, malvertising, and so many others.
Common Features of Phishing Emails
- Sense of urgency: a very common tactic of these cybercriminals is to tell you to act fast, else your account may be compromised or any other lie, when you come across these, the best thing to do is to ignore them, most reliable organizations give ample time before they terminate an account, and they never ask you to update personal details over the Internet.
- Too good to be true: most times these emails are of lucrative offers and eye-catching statements designed to attract people’s attention immediately, for instance they may claim you have won an iPhone, a lottery etc. Don’t just click on any suspicious email.
- Hyperlink: some links are not all that they appear to be, hovering over a link shows you the actual URL where you will be directed upon clicking on it. It could be completely different, or it could be a popular website with a misspelling, for instance www.bankofarnerica.com – the ‘m’ is actually an ‘r’ and an ‘n’, so look carefully.
An example of a phishing attack
Imagine that you saw these email do you see any sign that it’s a scam? but let get to analyze it.
- The email looks like it’s from a company you know and trust (Netflix). It even uses Netflix logo and header.
- it says your account is on hold because of a billing problem.
- The email uses a generic greeting “Hi Dear”, if it’s a business you hold an account with it should address you with your name.
- It invites you to click on a link to update your payment details.
At a glance, this email might look real, but it’s not. The scammers who send emails like this do not have anything to do with the companies they pretend to be. This can have a big consequence on the individual who fall victim and give scammers their details.
How to protect yourself
- Do not click on any links or open attachments from emails claiming to be from your bank or other institutions and asking you to update or verify your email.
- Look for the secure symbol. Secure websites can be identified by the use of ‘https:’ rather than ‘http:’ at the start of the internet address, or a closed padlock or unbroken key icon at the bottom right corner of your browser window. Legitimate websites that ask you to enter confidential information are generally encrypted to protect your details.
- Never provide your personal, credit card or online account details if you receive a call claiming to be from your bank or any other organization. Instead, tell them you would prefer to come over to the bank and resolve the issue.
- You can also protect your computer by using security software and by setting these software to update automatically so it can deal with any new security threats, you can also protect your accounts by using multi-factor authentication, some accounts offer extra security by requiring two or more credentials to log in to your account, which could either be something you have (like password) or something you are (like fingerprint). Multi-factor authentication makes it harder for scammers to log in to your accounts if they do get your username and password.
What to do if you suspect a phishing attack.
If you get an email or a text message that asks you to click on a link or open an attachment, answer this question: Do I have an account with the company?
If the answer is “No,” it could be a phishing scam. Delete the message or email.
If the answer is “Yes,” contact the company using a phone number or website you know is real. Not the information in the email. Attachments and links can install harmful malware.
What to do if you responded to a phishing email
If you think scammers have your details, like bank account number, credit card details, etc. visit https://www.identitytheft.gov. There you would see the specific steps to take based on the information you lost.
Stay Safe!!!