How to Spot a Phishing Email

What exactly is Phishing?

For those of you who might be unclear about the definition, it is the form of fraud in which an attacker impersonates a reputable person or company, usually through a scam e-mail or another form of communication. This can be done in a variety of ways, some of which include distributing malicious links or gaining user credentials and account information – hence the name phishing. Phishing is popular with cyber-criminals as it relies heavily on human error, something much easier to crack than computer code.

Phishing emails are consistently the most common form of cyber-crime, but despite the apparent growth in awareness about the method, people are still frequently falling victim. In fact, according to Verizon’s 2020 Data Breach Investigations Report, more than two thirds of data breaches involve phishing… Unfortunately, these attacks do not appear to be slowing down as cyber-criminals continue to take advantage of global events and prey on real-world concerns in order to cause a higher interaction and click through rate.

In an attempt to raise further awareness about phishing and to provide insight into what you and your employees should be looking out for, we thought we would take you through a real example of a phishing email received and spotted by one of our staff…

This phishing email was a particularly good fake, however there are still red flags that give away its lack of authenticity. Take a look at the email below, and we’ll explain why…

1) Always check the sender. This sender address does not appear to mimic a legitimate TV licensing email address. Always make sure you check the actual email address rather than just the sender name – if the sender address is still unfamiliar to you, always take a few extra minutes to examine the content of the email.

2) Do not be fooled by a ‘Protected’ or ‘Scanned for Malware’ message trying to lull you into a false sense of security… Is the web address correct?

3) Similarly, do not be fooled by official looking logo’s and images. Many cyber-criminals will use ‘scraped’ logos from a company in order to make their emails look legitimate.

4) Notice how this scam email is addressed to the ‘Customer’ rather than including any personal details? Likely because it is part of a generic email campaign sent to thousands of recipients… However, it is important to remember that using your name does not equal legitimacy – rather it’s more likely to be part of a spear phishing campaign sent to targeted individuals.

5) Spelling errors, poor grammar and low-quality graphics are often a key giveaway that you have received a phishing email… This example is nearly flawless, however in the larger bodies of text you can spot unprofessional and informal use of language that would be unlikely to be included in an official email.

6) Finally, do not click on any of the links included in a suspicious email. Notice how this email is littered with links for you to click such as ‘Sign in’, ‘Renew now’ and links to apparent social media pages? If clicked, these may take you to a criminal or malicious website… If you’re in doubt, you can hover your mouse over the hyperlink to see the full URL.

Key Takeaways

Cyber-criminals only require one error from an employee for their operation to be successful… Therefore it is integral to educate everyone in your organisation. Unfortunately, spam e-mail filters can never be guaranteed to be 100% effective, hence educating employees in understanding and recognising phishing campaigns is crucial.

Here at Stripe OLT, we additionally provide prevention through education. Our Cyber Security Education training days focus on specific areas of business risk and how to mitigate these appropriately. Our two types of training – Staff Cyber Awareness (SCA) and Executive Cyber Fundamentals (ECF) both include training on phishing campaigns, in order to provide your people with the information they need to become your business’s first line of cyber-defence. Get in touch here to talk to one of our cyber-security experts for more information on our tailored training days.

Remember, if you do receive an email that you are unsure about, you can always report it to the National Cyber Security Centre’s Suspicious Email Reporting Service by forwarding the email to report@phishing.gov.uk.