Online Phishing: How to Stay Out of the Hackers’ Nets

Despite the growing popularity of social media and messaging apps, email remains the preferred way to communicate online for millions of Americans. And the bad guys know it. Of the 28.6 billion cyber-threats Trend Micro blocked globally in the first half of 2019, over 24.3 billion were carried by email. That’s 91%. Many of these threats were made possible via phishing: a tried-and-true technique that hackers having been using for years.

Why is it so popular? Because it directly targets what they believe to be the weakest link in home cybersecurity: you, the user.

Phishing can lead to data theft, identity fraud, sextortion, ransomware, or infection with a host of dangerous malware. So what can you do to stay safe?

What is phishing, exactly?

Phishing at its heart is a confidence trick. Attackers use a technique known as social engineering to manipulate the victim into doing their bidding. Usually they achieve this by spoofing their email so that it appears as if sent by a legitimate entity, like a bank, an insurance provider, a popular technology company, or even a friend.

They either want your personal data, your money, or for you to unwittingly download malware to your machine — by clicking on a malicious link or opening a malicious attachment. So, in order to get you to do this without thinking too hard about it, they’ll typically create a sense of urgency. For example, your bank contacts you saying you need to urgently update your details to avoid extra charges, or the IRS says you owe them an outstanding sum that needs to be paid immediately.

Sometimes they use the “carrot” rather than the “stick” approach. Phishing emails can be crafted to offer huge discount sales on popular items, such as during the upcoming Black Friday holiday weekend. In fact, capitalizing on popular events is a classic phishing ploy: there have already been numerous warnings ahead of the upcoming US 2020 Census.

Harder to spot

Unfortunately, the days when phishing emails were easy to spot are long gone. Today, successful cyber-criminals are much savvier. There are fewer typos and grammatical mistakes in emails, and the sender’s domain, writing style and corporate logos are often convincingly spoofed.

Hackers have also been able to make their emails look more legitimate by packing them with more of your genuine details. Every time a company you have stored personal details with is breached or leaks its customer databases, hackers can gain access to a trove of personal data to use in follow-on phishing attacks. The latest was Adobe, although breaches at delivery firm DoorDash and the American Medical Collection Agency, among many others this year, exposed personal data on millions of Americans. Along with your email address, hackers get your full name, account details and history, which they can use to trick you into handing over more details.

What are the phishers after?

As mentioned, the hackers behind phishing attacks are basically shooting for a handful of outcomes. These are:

	Data theft/identity fraud

They either want your personal and financial data to sell on the dark web to scammers, or to use themselves to commit identity fraud. The easiest way of getting this is by tricking the user into clicking through to a separate phishing page, where they’re prompted to enter their details. Like the email, the page itself is spoofed to appear as if hosted by a legitimate company.

Often, all they need is your log-ins, which provide the keys to your most sensitive online accounts, like internet banking, health insurance portals, and even Uber and Netflix. The latter can be sold on dark web marketplaces to offer unscrupulous buyers free streaming or taxi services, for example.

	Malware downloads

By clicking through in a phishing email, you could also be unwittingly downloading malware to your machine. It could be ransomware designed to lock you out of your PC until a fee is paid, or covert crypto-jacking malware which will cause your machine to run slowly while it mines for cryptocurrency using your power supply. It could also be a banking Trojan designed to steal your banking log-ins.

	Sextortion

An emerging extortion scam involves tricking the user into believing they have been filmed via their webcam in a compromising position. Usually, the attacker threatens to release the footage to all of the victims’ contacts if they don’t pay a ransom. Sometimes they use previously breached data, such as the target’s email password, to add legitimacy to the scam.

Trend Micro data reveals that these so-called “sextortion” schemes more than quadrupled from the second half of 2018 to the first half of 2019.

How can I stop it?

Fortunately, there are a number of things you can do to protect you and your family from the impact of phishing emails. A combination of user awareness and technology filters from a reputable cybersecurity vendor is a great place to start.

Consider the following:

Be wary of any unsolicited email, even if it appears to come from a reputable vendor Don’t click through on any buttons in unsolicited emails, or download attachments If an email asks you for personal data, check directly with the source independently, rather than clicking through/replying Although becoming rarer, spelling and grammatical mistakes in emails are often a sign of phishing Remember, if a special offer looks too good to be true, it usually is Invest in anti-phishing cybersecurity tools from a trusted vendor

How Trend Micro can help

Trend Micro Security offers capabilities to filter out malicious phishing and spam emails before they even hit your inbox, or to examine them if they do. These include:

	Antispam for Outlook analyses any links contained in emails, as well as checking the reputation of the sender, to block phishing emails. It also prevents the installation of malicious files on the user’s machine.

Click Internet & Email Controls > Spam & Emailed Files to open the panel. You can then check the boxes to:

	Filter out unsolicited advertisements and other unwanted email messages from your Outlook inbox Check for threats in files attached to email messages.

You can also increase the strength of your spam filter in Settings:

High detects almost all spam and fraudulent messages but may misidentify some legitimate email as spam Medium detects most spam and fraudulent messages and runs only a moderate risk of misidentifying legitimate email as spam Low detects only the most obvious spam and fraudulent messages, with only a slight chance of identifying legitimate email as spam Fraud Buster uses cutting-edge AI technology to identify scam emails that don’t contain malicious URLs or attachments but still pose a risk to the user. It protects Gmail and Outlook webmail in Internet Explorer, Chrome, and Firefox on your PC, as well as Gmail on your Mac.

Once switched on, it will send a warning pop-up when you open a scam email, telling you to not follow any instructions contained in the email. You can then decide to Report Dangerous to report the scam or click on Looks Safe to bypass the warning (not recommended). There’s also an option to View Details in the popup to get more info on the scam.

To find out more about the dangers of phishing and malicious spam and how Trend Micro can help protect you, watch our YouTube videos:

For more information, go to our website for a Security Products Overview.

Tags: Phishing, Spam, Anti-Fraud, Internet Security

Read More HERE