The Dangers of Phishing and How to Avoid It 

Phishing refers to the fraudulent practice of obtaining personal or confidential materials through the use of emails, phone calls, or other methods of communication. A 2022 survey revealed cyber-attacks as the #1 risk facing companies. Crowdstrike, a large American-based cybersecurity company, stated on March 20, 2024, that Phishing is the #3 most common type of cybersecurity attack against businesses. A successful phishing attempt by a malicious actor can result in compliance issues, loss of customer data and trust, lost revenue, theft, or destruction of company property and resources - or worse. So how can we recognize phishing attempts? How can we avoid them? 

Social engineering refers to a set of tactics malicious actors can employ to trick, convince, and deceive potential victims into giving away information in error. There are as many methods to phish as there are ways to communicate, but the methods that are typically used are: Emails, Phone Calls/Voicemails, and Text messages. 

1. Emails 

Emailing is the most common method of phishing. With the utilization of bots, bad actors can generate and send out thousands of emails instantaneously in a "shotgun" attempt. They don't need every attempt to be successful if they can convert even a small percentage of potential victims. Typically, phishing emails will present themselves in the form of fake invoices for things you didn't purchase, an email that appears to be from your bank, or even an email from a work colleague or friend. A rule of thumb to avoid falling victim to email phishing is to always look at the domain of the email address of the sender. For example, if you bank with ABC Bank and an email presenting itself as from ABC Bank has a sender address of random letters or numbers (jon@xyaqw1828.net), do not open any links or call any numbers in the email. Always call your bank directly or go directly to your bank’s website in your internet browser. When in doubt, don’t click. Get the official phone number for the business supposedly emailing you and give them a ring. 

2. Phone Calls/Voicemails 

Most people will be aware of this type of phishing if you've ever received a phone call from the IRS saying you owe taxes. However, a less common occurrence of this type of phishing is called spear phishing. By learning a few publicly available facts about a company (perhaps employee names from their own website or social media), a malicious actor can deceive a potential victim into building a sense of trust and appropriateness to requests for information. Always ask yourself if you can verify the authenticity of the person on the other end of the line, whether you were expecting the call in the first place, and if the type of information they are requesting is appropriate to be casually sharing with a relative stranger over the phone. 

3. Text Messages 

Remember when I mentioned emailing was the most common method of phishing? Recent reports suggest that text messages are catching up. And fast. The modern convenience and proliferation of smartphones into the hands of nearly every person in the world has created an opportunity for phishers to target users more efficiently on a scale that wasn’t available via only email. After all, the average end-user is far more likely to quickly check a text message than to check their email. Although the medium is different, the method is unchanged. Avoid responding to or clicking links in unknown or unexpected text messages. 

Never supply information to someone who doesn’t need it. If you unexpectedly receive any kind of a link for a login, even to a website you trust, do not click the link and absolutely do not log in via that link. Always go directly to the purported source of the message or phone call and verify the request for information directly. Be safe out there!