How to Spot Phishing

Tips on how to spot phishing techniques

Successful phishing and spear-phishing attacks can cost a company millions of dollars, destroy business reputations, undermine customer trust and result in legal action and regulatory fines. Clearly, knowing how to spot phishing attacks can help to prevent these devastating consequences.

Here are a few phishing tips that can help users understand how to spot phishing techniques.

1. Look for inconsistencies in links, addresses and domains. Phishing emails often have email addresses that are different than the name on the email account. They may also use domain names that appear to be slightly off in some way. Users can hover on a link to check the address before clicking – oftentimes, links will lead to sites that have nothing to do with the purported sender's domain.

2. Watch out for bad spelling and grammar an unfamiliar language. Phishing attacks often originate in other countries – watching out for unfamiliar language or inaccurate spelling can help to identify phishing emails.

3. Be suspicious of demands for urgent action. Phishing attacks often demand an urgent response and may even threaten recipients with negative consequences unless they respond immediately.

4. Be wary of attachments. Be completely sure of a sender's identity before opening any attachment, even from one that appears to be from a trusted source.

FAQs: How to spot phishing

How does phishing email work?

A phishing email is a fraudulent message designed to lure a recipient into visiting a website where their sensitive information can be collected by attackers and where malware may be downloaded to their computer. Phishing email mimics the design of a reputable company, making it appear as if the message was sent by a person or organization that the recipient knows and trusts. Typically, a phishing email will encourage the recipient to act quickly to take advantage of an offer or to avoid penalties and negative consequences, and require them to enter passwords, bank account numbers, credit card information, Social Security identification or other personal data into forms on a fraudulent website. Once that data is collected, attackers may use it to access the recipient’s accounts and steal identities, data and money.

How to spot a phishing email?

There are several ways to spot to phishing scam.

• Inconsistencies in email addresses, company domains and URLs. Frequently, the domain in the sender’s email address is not an exact match for the company they purport to belong to. Also, the URL in the text of an email will not match the actual link address, which can be seen by hovering the mouse cursor over the link.
• Requests for personal information. Legitimate companies rarely send emails asking recipients to enter personal information into forms on a website.
• Threat of negative consequences. Phishing emails often use fear to induce recipients to act. Messages may suggest that users must login to prevent money from being lost, accounts from being closed, or legal action from being taken against them.
• Non-personalized communications. Phishing emails will typically not use the recipient’s name within the email, using a salutation like “dear customer” instead.
• Poor spelling and grammar. Many phishing emails include misspelled words, unusual language and poor grammar.
• Suspicious attachments. Phishing emails may contain attachments such as fake invoices.

How to spot a spear-phishing email?

While phishing campaigns send emails to many people and hope a few will bite, spear-phishing campaigns are highly targeted to fewer individuals. Attackers may research targets and use information from online profiles and social media to fill an email with enough detail that the recipient believes it’s from a trusted source. Spear-phishing email recipients are usually higher value targets who have the potential of providing data or taking actions that can deliver a significant amount of money, access or data to the attackers. An email may be part of a spear-phishing attack if:

• It makes an urgent request for the recipient to share information, download a file, initiate a wire transfer or open an attachment.
• The domain in the “from” address is not an exact match of the company’s domain.
• The email contains “disguised links” where the link’s real address (which can be seen by hovering the cursor over the link) is different than the text for the link that appears in the email.

How to spot a phishing website?

A website used in a phishing attack will likely have many of the hallmarks of a phishing email, including:

• A sense of urgency. Phishing websites often use language that has a sense of urgency and desperation, which you won’t find on legitimate websites for banks, shipping companies and other reputable institutions.
• Phishing websites are not written by business and marketing professionals, so they tend to have lots of misspellings, grammatical errors and language mistakes.
• Incorrect URLs. Phishing websites will often us a “http://” prefix instead of the standard “https://” prefix, which indicates a site is secure. Also, the spelling of the URL for a phishing website will often be slightly different from the company it purports to represent.
• Poor design. You can usually spot a phishing website by looking closely at the design, and especially the resolution of images. Because attackers usually build sites quickly, they’re more likely to use low-resolution images and to build sites that don’t look quite as professional.

How to block phishing email?

The best approach to preventing phishing attacks is to adopt multiple layers of security that include:

• Security awareness training that teach employees how to recognize phishing email and what to do when they receive one.
• Anti-spam and anti-malware software that can spot phishing attacks and block email from reaching users.
• DNS authentication services that include SPF, DKIM and DMARC protocols to prevent spoofing and impersonation.
• Anti-impersonation technology that can spot phishing email with header anomalies, domain similarity and other signs of social engineering-based email attacks.
• Solutions that scan every link and attachment in every email and prevent users from accessing them if they are determined to be malicious.