Phishing

What Is Phishing? Learn how to protect your business

Phishing is no longer a minor inconvenience; an issue solely frustrating the private individual. As millions of businesses now operate online, phishing is a multi-million-dollar operation targeting companies. In this Abion guide, we’ll explain how it works and provide you with the tools to protect yourself against the plague of scams and malware aimed at stealing your information.

How does Phishing work?

What is the meaning of phishing, and why are phishing scams so successful? You don’t need years of IT experience to learn how to defend your business against those after your information. Phishing attacks, by definition, are solely designed for one thing - theft.

Phishing (in a nutshell) is a series of methods designed solely to access your personal information. That may be sensitive company secrets, emails and correspondences, customer account details, internet banking information, passwords, client phone numbers, transaction histories - you name it.

There are thousands of phishing scams out there, but they predominantly work the same way. Email and text messages are the most likely avenues for assault, with the sender posing as a real person or a service.

The purpose is to steal information from you, either for the perpetrator's own ends or to sell it on to interested parties. Who’d be interested in your client list, and how much can that possibly be worth, you ask? You’d be surprised.

The main methods of attack

Aside from crafty calls, dodgy texts and phishing emails, several methods of attack can define phishing further, and all are equal forms of internet fraud. To better help you understand how they work and how to recognise them, we need to look at the most common ploys and types of phishing scams out there.

• Spoofing
  This involves the creation of dummy websites or identities. These websites will look like the real deal, or you may believe you’re engaging with someone from a genuine business. This form of URL phishing is one of the oldest.
• Spear Phishing
  A spear-phishing attack is targeted and calculated. A specific company or individual will be chosen for this scam, with the sole purpose being to obtain critical data of vital importance to the victim.
• Cybersquatting
  This involves a cloned website designed to mimic or mirror a real one. You could easily be forgiven for assuming you were visiting an actual site.
• Typosquatting
  Typosquatting is nearly identical to cybersquatting, albeit not as advanced. There will often be tell-tale signs that give the game away, including a misspelt URL. That will suffice to catch out unsuspecting parties, but won’t fool everyone.

It is not uncommon for perpetrators to utilise a combination of the above phishing types and methods to obtain information.

By hook or by crook - the key steps you need to know

There are typically two common ways in which you can fall victim to phishing. Both are generally email-based, but the way they work differs.

What is a phishing email? Email phishing is arguably the most common method. This involves sending an e-mail that contains a link or a series of instructions. It is through this link that the perpetrators will obtain your details. One of the most common phishing examples targets individuals, and could look like this:

• You will receive an email. It may tell you that you’ve been erroneously charged for a purchase. It will contain a link to a dummy site (that looks realistic) where you are to use your login details to “claim a refund”. After doing so, the phishers will obtain your login details and use those as they see fit.

Of course, this doesn’t fit all phishing email definitions - there are a lot more complex and, dare we say, inventive scams out there. However, most will attempt to convince you that they are a trusted source, perhaps a bank. This is predominantly why banks repeatedly stress that they will never ask for your login details or card numbers. Most don’t reach out to their customers via email for this reason.

The second most common attack pattern also begins with an email. However, this time, the phisher relies on spyware to do the job for them, like so:

• You will receive an email. It may again claim that you’re entitled to a refund or consist of any other cherry to tempt and lure you. However, instead of a link urging you to sign into your account this time, the link (once clicked) will install spyware on your computer.

Falling victim to phishing malware is arguably a worse outcome. Instead of obtaining your login details for a single website, the phishers can now effectively control your PC, browse it, and obtain any saved information, including sensitive information for multiple accounts and services.

How to recognise and prevent Phishing

The trouble with phishing is that those responsible are difficult to get a handle on. However, many phishers are based offshore, making it mightily challenging to track them down, land convictions and thus, stop phishing attacks. That said, having robust internet security indeed makes it harder for them to target your business. 

Like most “industries”, the phishing sector has grown, and this was highlighted during the COVID-19 pandemic, when most of the Western workforce sat behind their laptops at home, often away from secure servers and without the customary array of in-office tools. 

With scammers now encouraged to try ever-riskier tactics, becoming aware and keeping abreast of the latest phishing scams will undoubtedly help repel such attacks. Monitoring your digital presence will play its part, as will protecting your business with the newest internet security packages. Changing your passwords regularly has been proven to help, too.

The tell-tale signs of Phishing attacks and how to spot them

Long gone are the days when emails from unpronounceable princes in far-off lands claimed to want to give you stacks of cash. Phishing scams are now far more complex, yet many are easy enough to spot if you know what to look for. Understanding the tell-tale signs of phishing attacks can often work wonders. We’ve detailed some well-known giveaways below:

• Keep a close eye out for lacklustre grammar and poor spelling. Many phishing attacks are run by those who don’t have the same fluency as you.
• When asked to verify anything to do with financial transactions you didn’t sign up to, always raise an eyebrow.
• Be sceptical of any link that requires you to sign in. Always visit the site manually rather than follow a link.
• If you’re not due a refund and haven’t won anything, don’t be fooled into thinking a dividend is coming your way.
• It is typically safe to ignore anything from a sender or address that you don’t recognise or that can’t be verified.
• Most dummy corporations and businesses don’t have the credentials that will stand up to scrutiny. Doing a little research into an alleged company can help unravel their story.
• Be wary of any unrecognisable email addresses, especially vague ones. Andersandersson@mail.com, johnsmith@geemail.com, and customerservice@aws32.com are just a few comedic examples that would stand out.

Of course, as a business leader, you can’t be expected to babysit your entire workforce. You can do everything to protect your business, but your employees must also step up and take up the reins. 

It pays to educate your employees on the perils of phishing. Ask them, “what is phishing, or what is a phishing attack?” You might be surprised to learn that they aren’t as clued-in regarding scams and the phishing attack examples listed above as you might believe. Providing your company with software, teaching staff to run scans regularly, and showing them simulated phishing attacks so they can understand what one looks like are recommended practices. 

Restricting the admin rights of employees, with only a handful having administrator privileges, is commonplace in the IT and business world. Regularly applying security updates and patches to software as soon as they are available and purchasing software that blocks dubious email addresses and websites is the minimum you should do.

How we protect your business from Phishing attacks

You are not in this battle alone. Here at Abion, we have industry specialists skilled in digital security. We regularly support companies and organisations, from businesses with just a handful of employees to those with many. If you want to learn how to stop phishing emails and put an end to dangerous phishing schemes, we’ve got the tools to help.

Our smart services are readily available for all businesses, and you don’t need to be overly tech-savvy to use them. Here’s a brief look at what Abion can provide your company.

Secure Email (ECP)

Our Secure Email (ECP) solution has been developed in-house. It effectively protects your business from fraudulent emails and can be extended to cover your customers and suppliers to boot. Comprising SPF, DKIM and DMARC systems, you can prevent unauthorised users from sending correspondences from your domains, verify any emails sent, and firewall any hazardous messages before they reach your email client.

Verified Mark Certificates

Using our VMC (Verified Mark Certificate) software, we can implement a logotype adjacent to your brand name in each verified email sent from your domain. This certificate allows recipients to be confident that they can trust the source and legitimacy of the emails sent from your brand. With our VMC package, you can rest assured that your company’s reputation amongst clients remains untainted by phishing.

TLS/SSL Certificates

Abion’s TLS/SSL certificates secure data and encrypt traffic between your server and your recipients. This prevents outsiders from obtaining sensitive data. We offer single year and multi-year plans (of up to six years), ensuring that any data you wish to remain secure stays so.

DMARC

Built on top of the ECP, our DMARC system monitors and prevents abuse of your domains. DMARC can verify the authenticity of a sender before passing the message on to your email client. This service is only available through our ECP package.

Anti-Spam Services

While a more straightforward tool than the others, we also provide anti-spam services for our customers. If you eagerly want a filter system applied to incoming emails, our software allows you to fish out the spurious messages from those coming from trusted sources.