HOW TO KNOW IF FRAUDELENT EMAILS ARE ATTACKING?
“Over 3.4 billion fraudulent and phishing emails circulate every day. This number adds up to a trillion fraudulent emails per year.”
What you need to know to report a fraudulent email?
These numbers help in knowing about the fraudulent emails. The
typical inbox is overflowing with emails from colleagues, partners, friends and
relatives, third-party vendors, newsletters, advertisements and, camouflaged
among them, some from cybercriminals. Added to this glut are busy workdays and
the pressure to read and reply to every email.
How to report a fraudulent email?
To report
a fraudulent email, here are the steps to follow:
Report the fraudulent email to the IT department or their
manager.
Make sure your employees know about company security policy
and how to report fraudulent email. As part of your ongoing campaign to promote
cybersecurity awareness, remind employees, through email newsletters, posters
and other communications, how to report fraudulent emails and let them know to
whom address.
Report the fraudulent email to the email service provider
Most email service providers offer built-in mechanisms to make
it easier to report fraudulent emails. The phishing report button can be
activated in Outlook, Gmail, Yahoo! and others.
If your employees are checking their personal emails at work,
make sure they have turned on the report phishing button) and remind them that
they need to be proactive about this threat (even with their personal emails).
Report the fraudulent email to a governing body.
The majority of countries have bodies with authority to deal
with malicious emails. In the United States, these emails can be sent to Cyber
Security and Infrastructure Agency, in Canada at the Canadian Anti-Fraud Center,
in the UK to National Fraud, and Cyber Crime Reporting Center.
Place the sender in the spam or fraudulent emails list
Add the sender of the e-mail to the list of spam or fraudulent
e-mail authors in your e-mail. Then, move any e-mail from that sender to the
spam or scam mailbox, to remove them from the main inbox.
Delete
email
Delete the email, then empty the deleted messages folder.
It is very important that your employees know what to do when
they receive a phishing email. Make it easy for them to report this email, and
let them know that they are doing the right thing.
What is phishing?
To report it, you must first know what phishing is, and how to
recognize it. Phishing is a cybercrime that uses email, website and text
message scams to steal confidential business or personal information.
Cleverly crafted email scams trick employees into providing
personal information such as date of birth, address, credit card information,
account passwords, and social insurance number. Using social engineering techniques,
cybercriminals craft convincing emails that trick victims into believing their
email is legitimate.
Phishing works when an unsuspecting victim responds to a
fraudulent request, such as an email that prompts them to take action. This
gesture can be to download an attachment, click on a link, fill out a form,
update a password, or confirm credit card information.
Often times employees don't recognize the signs of a phishing
email, and it is very easy to get caught up in the fast pace of a workday. Hence
the importance of providing them with training and education to make them aware
of phishing.
How to recognize a phishing?
To know how to recognize a fraudulent email, remind your
employees that there are six main indicators of a fraudulent email, which you
should especially avoid answering, trusting or clicking.
Here are
the top six indicators of email fraud:
Sender
Cybercriminals know that people are busy and don't carefully
examine the sender of an email. These criminals also know that people are naturally
inclined to trust, which makes it very easy to trick them into believing that,
knowing the sender, the email must be legitimate.
• The sender's name and email address are very easy to forge.
• Just because you think you know the person sending the email
doesn't mean its safe.
Remind your employees to always check carefully if the
sender's name and email address are spelled correctly. Advise them to hover
their mouse over the name of the sender of the email and check if their name
and email address are legitimate.
Greeting
Normally, emails are personalized and do not use vague
greetings such as "Dear Customer", "Dear Consumer", or
"To Whom It May Concern". These greetings should be viewed with
suspicion, especially if the email is from someone you know or from a company
you've worked for.
Content
Cybercriminals know how to compose emails using clever social
engineering techniques that trick people into taking action and believing that
by replying they are doing the right thing.
Remind your employees to watch for these clues in the content
of an email, often indicating fraud:
• Grammar and spelling mistakes or poorly structured
sentences.
• Language that attracts attention and evokes urgency to
create a sense of panic prompting to take action. For example, your account
will be locked if you don't respond immediately.
• Request for confidential, personal or corporate information.
Several cybercriminals send emails that appear to be from a bank, major online
merchant, or government body asking the recipient to confirm an account, credit
card, or social insurance number. No legitimate organization will ask for this
kind of information by email.
• Password that must be reset immediately on the pretext that
the company has been defrauded or that its database has been corrupted.
Link or
button
Phishing attacks usually include a link or button that directs
the recipient to a fake website. This fake site looks real, but the domain name
is not legitimate. For example, a cybercriminal could recreate the Amazon
account page, but the URL is amazon.accountsupdate.ca instead of amazon.ca/gp/css/homepage.html.
Remind your employees to never click a link or button in an
email, and instead should open a new browser tab and manually enter the website
URL, or use a bookmark.
Attachment
Attachments are used by cyber criminals to install malware on
a computer and potentially on the corporate computer network. This malware can
then lock down the computer or entire network, install software that logs
computer keystrokes and passwords, or install a virus capable of corrupting
files, with a ransom note.
Remind your employees to never open unexpected attachments in
an email or on an external USB drive, and to avoid activating macros in
documents in production.
Contact
information
Legitimate organizations and employees request a response by
providing contact information so that it is easy to contact them. Watch the
salutation carefully and look for a phone number and address, and verify that
the email address in the salutation matches the sender's email address.
Remind your employees that when in doubt about the legitimacy
of a message, they should contact the sender to validate their request using
contact information from a trusted source (e.g., a website official web), not
the email information itself.
Emphasize to your employees that acting safely avoids a lot of
regrets. During your cybersecurity awareness training, make it clear that you
want your employees to remain suspicious of the emails they receive. Tell them
that it's best to take the time to read the entire email carefully and, if in
doubt that they should speak to an in-house cyber hero or in the IT department.
They should feel comfortable reporting a situation even after clicking, since
the damage might be limited in this way.
How to protect employees from phishing and email fraud?
The best way to protect employees against phishing, email
scams, and other cybercrimes is to strengthen cybersecurity by continuously
communicating messages to that effect. Your employees are your first line of
defense against cybercrime.
You should always have an update antivirus software in
all your employees’ devices that can track if anything wrong happens in their
device.
By increasing phishing awareness and training in-house cyber heroes, you protect your business and your employees from the risks and threats posed by the approximately 3.4 billion phishing emails circulating every day.
Comments
Post a Comment