Some useful tips to help identify phishing scams, but beware, the criminals are getting smarter. Some scams may not trigger the alerts listed in this article from Trend Micro:
What Does Phishing Look Like?
People are still falling prey to phishing scams, so what can be done? “The first step is helping people realize what phishing looks like,” says Jamz Yaneza, Threat Research Project Manager for Trend Micro. “If people recognize email or phone calls as suspicious, they are less likely to bite.” The following are some common characteristics that may help identify phishing scams, as well as some advice to avoid being scammed:
Misspellings and Poor Grammar
Phishing often starts with email. Although most such email remains targeted toward U.S. users, non-native English speakers are often the authors. For this reason, some emails appear to be written in broken English, with misspellings and poor grammar. “Take this observation with a grain of salt,” warns Yaneza. “Cyber criminals are now outsourcing these communications to professional writers and designers. Only 70 percent of what I see looks unprofessional, and that number is dropping rapidly. It is becoming increasingly difficult to distinguish legitimate email from spam.”
Never Send Information Via Internet
Many consumers remain unaware that banks and other companies never request sensitive, personal information over the Internet. Also, banks never call and ask for bank account information or Social Security numbers over the telephone. It’s best to personally vow to never disclose sensitive information when receiving an email or telephone call. Only provide private information when first initiating a phone call to verify the identity of the person at the other end. If requested to provide a Social Security number, ask to provide the last four digits only. For example, phone companies request a Social Security to verify account information but will accept the last four digits alone if callers provide additional proof of identity.
Beware of Clicking
Spam itself is not dangerous—it’s what users do after receiving the spam that creates phishing problems. For example, suppose that a user receives a spam email requesting the user to click on an additional link to learn more or provide more information. This is where the trouble begins. Refusing to click on embedded links can circumvent a phishing attack. “Banks and other organizations never ask users to download software,” says Yaneza. “Occasionally a bank will request users to download a browser helper toolbar but that is becoming rare as phishing attacks increase.”
Avoid Ploys for Help
Although many volunteer organizations now use email to solicit donations, it is best to verify a request for a contribution by calling the organization directly. Many phishing attempts, such as the 419 scams described in the first article, are disguised as solicitations for helping someone in need.
Stop Forwarding e-Petitions
Email chains and online petitions are almost never legitimate. Instead, they are initiated by scammers searching for quick and easy ways to collect a mass email list. Unfortunately, people who forward these emails to friends and family are playing right into criminals’ hands. Some petitions feature names, addresses and email addresses. An e-petition is unlikely to actually find its way to the White House, for example. Upon closer inspection, most emails fail to request that a certain action be performed to resolve a problem. For example, a popular e-petition supposedly originating from Mothers Against Drunk Driving (M.A.D.D.) contains no call to action or instructions once the list reaches its stated 5,000 person signature goal. [1] Spammers use these lists to perpetrate phishing and other Internet crimes.
Be Vigilant
Consumers are the first line of defense in protecting against phishing attacks. The best advice is to open attachments from known or expected sources only and to delete all unwanted and suspicious messages. If email arrives from a known company or Web site, only click on links that are hosted on the same site. Redirections to another site are a sure sign the email may not be legitimate.
Technology Solutions
For maximum protection against phishing, implement a comprehensive anti-phishing solution, comprising protection at all possible entry-points—including the Internet gateway, messaging gateway, endpoint clients, endpoint servers, and the network. Trend Micro offers a variety of anti-phishing solutions to suit both consumer, small to medium-sized business and enterprise needs. In addition, keep all operating system, browser, desktop applications, and instant messaging (IM) security patches up to date to guard against the newest phishing scams.
