Identifying Phishing Attacks

By: John Neall

Phishing is when someone sends an email to you posing as someone else. But what elevates it to the category of "phishing" is when the message body contains links that attempt to get you to give up information (passwords, credit card numbers, personal information, etc.) or attempts to "trick" you into installing malware or a virus. Because it looks legitimate, the email convinces you to click on a hyperlink pointing at somewhere you don't want to go. If the link you are being asked to click doesn't match up with what you would normally expect, you can be fairly certain that the email is a phishing attack. This can be particularly harmful in a company setting where individual computers share multiple interoffice networks. Here are some quick tips to help identity these attacks:

1. Hover your mouse over any link in the email (but don't click!): You should see a pop-up with the actual address of the hyperlink. If you don't, then you can be fairly certain this is a phishing attack.Sometimes the attacker will mix in valid hyperlinks with invalid ones or send a hyperlink with a misspelled URL. Be sure to look very closely at the pop-up before you can safely decide to click on it.
2. Verify https (SSL): Whenever you are passing sensitive information such as credit cards or bank information, make sure the address bar shows "https://" rather than just "http://" and that you have a secure lock icon at the bottom right hand corner of your Web browser. You can also double-click the lock to guarantee the third-party SSL certificate that provides the https service. Many types of attacks are not encrypted but mimic an encrypted page. Always look to make sure the Web page is truly encrypted.
3. Don't enter sensitive or financial information into pop-up windows: A common phishing technique is to launch a bogus pop-up window when someone clicks on a link in a phishing e-mail message. This window may even be positioned directly over a window you trust. Even if the pop-up window looks official or claims to be secure, you should avoid entering sensitive information because there is no way to check the security certificate. Close pop-up windows by clicking on the X in the top-right corner. Clicking cancel may send you to another link or download malicious code.
4. Make sure you have good anti-virus software/spam blocker: There are millions of these phishing attacks created every day and identifying them and blocking all of them is nearly impossible. Having the right software to handle multiple attacks is crucial.
5. Knowledge is power: Be very cautious when clicking on links in an email. If it doesn't look right, delete the email or forward to someone in your IT department to see how they can help.

Don't get 'hooked' by these phishers. Following these steps will help make your online experiences more safe and secure.

Back to top.