Phishing an Evil That Robs You

Cybercriminals use phishing to steal privileged credentials to get access to your bank and credit card accounts. Cybercriminals can quickly create fraudulent landing pages and websites to drive phishing, malware, credential theft, and ransomware attacks. Cybercriminals are always sharpening their social engineering skills, making phishing and spoofing attempts difficult to spot.   

Here’s a fundamental for protecting yourself — If an email looks strange, don’t open it. Spelling and grammar errors are tell-tale signs of phishing emails. Never click on links or download attachments from people you do not know.

Some  all-too-common examples of email phishing include:

• Business email compromises attack targets people in a finance department of an organization, often the CFO, and attempts to deceive them into sending large sums of money. Attackers are persuasive in convincing the recipient that sending the money is urgent and necessary. 
• Clone phishing: In this attack, criminals make a copy—or clone—of previously delivered but legitimate emails that contain either a link or an attachment. Then, the phisher replaces the links or attached files with malicious substitutions disguised as the real thing. Unsuspecting users either click the link or open the attachment, which often allows their systems to be commandeered. Then the phisher can counterfeit the victim’s identity in order to masquerade as a trusted sender to other victims in the same organization.
• Nigerian scams: Come from someone claiming to be a Nigerian prince or some other nobleman. This “prince” either offers you money, but says you need to send him a small amount first in order to claim it, or he says he is in trouble and needs funds to resolve it.
  The number “419” is associated with this scam. These scams are actually in violation of  Section 419 of the Nigerian Criminal Code dealing with fraud, the charges, and penalties for offenders.

Vishing (voice call phishing)

With phone-based phishing attempts, sometimes called voice phishing or “vishing,” the phisher calls claiming to represent your local bank, the police, or even the IRS. Next, they scare you with some sort of problem and insist you clear it up immediately by sharing your account information or paying a fine. They usually ask that you pay with a wire transfer or with prepaid cards, so the payments are impossible to track. 

Smishing (SMS or text message phishing)

SMS phishing, or “smishing,” is vishing’s evil twin, carrying out the same kind of scam (sometimes with an embedded malicious link to click) by means of SMS texting.

Catphishing or Catfishing

Catfishing (it can be spelled with an “f”)  hooks people wanting a relationship. The pandemic has isolated millions of people creating loneliness. People feel like nobody in the world cares for them.  See loneliness as an opportunity, fraudsters create a presence in social networks as a “sock puppet” or fictional online persona for the purpose of luring someone into a relationship—usually a romantic one—in order to get money, gifts, or attention. These wholly fictitious people gain rapport and once establishing that get access to information and/or resources that belong to unknowing targets.

Spear phishing

Phishing vs. spear phishing: While most phishing campaigns send mass emails to as many people as possible, spear phishing is targeted. Spear phishing attacks a specific person or organization, often with content that is tailor-made for the victim or victims. It requires pre-attack reconnaissance to uncover names, job titles, email addresses, and the like. The hackers scour the Internet to match up this information with other researched knowledge about the target’s colleagues, along with the names and professional relationships of key employees in their organizations. With this, the phisher crafts a believable email sent to an employee whose responsibilities include the ability to authorize payments. The email purports to be from an executive in the organization, commanding the employee to send a substantial payment either to the exec or to a company vendor (when in fact, the malicious payment link sends it to the spear phiser).

Whale phishing

Whale phishing is what it probably sounds like: Phishing that targets high-profile victims. This can include celebrities, politicians, and C-level businesspeople. Typically, the attacker is trying to trick these well-known targets into giving our their personal information and/or business credentials. Whaling attacks usually involve social engineering efforts to trick the victim into believing the deception. 

Health care

Health care is the most targeted sector for data breaches. The HHS Breach Portal, a useful online reference to all healthcare-related breaches and ransomware attempts, shows that there have been 472 healthcare-related breaches affecting 35.3 million patients between January and October of this year, according to a briefing earlier this year by the U.S. Health and Human Services (HHS) Cybersecurity Program. The top nine breaches alone affected 17 million patients.

Your Credit Cards Fall Victim to Cyber Thieves

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Computer software is another area of phishing. Here’s an example:

Notice the email address it was sent from looks strange. I have cut out part of it to avoid any problems. You should never pay a bill like this for a product you don’t’ use and even more important is to notice the email address sending the message. It looks phony.

From: Billing Confirmed [mailto:gol…675757@gmail.com]
Sent: Monday, October 18, 2021 10:06 AM
Subject: Order update#0022358

Fake email from the Internal Revenue Service is another phishing example. 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Identity theft is all too common. Here are some things you can do to protect yourself:

• Don’t open e-mails from senders you are not familiar with.
• Never click on a link inside of an e-mail unless you know exactly where it is going. 
• You can mouse over the link to see if it’s a legitimate link.
• If you get an e-mail from a source you are unsure of, one way to check this is to independently entering into your browser the site of the legitimate website identified in the suspect email.  If what you find doesn’t correspond to what email says purports, you know to disregard the email.   
• Look out for the digital certificate of a website. Effective anti-virus software will tell you if a site lacks a digital certificate.
• If you are asked to provide sensitive information, check that the URL of the page starts with “HTTPS” instead of just “HTTP.” The “S” stands for “secure.”It’s not a guarantee that a site is legitimate, but most legitimate sites use HTTPS because it’s more secure. HTTP sites, even legitimate ones, are vulnerable to hackers.
• If you suspect an e-mail isn’t legitimate, take a name or some text from the message and put it into a search engine to see if any known phishing attacks exist using the same methods. “Pair the name or message text and phishing or scam.”