You get an email from [email protected] claiming that they have found suspicious activity on your credit card statement and are requesting that you verify your financial information.
What do you do? While you may be tempted to click on a link to immediately resolve the issue, this is likely the work of a cybercriminal.
Phishingis a scam that tricks you into voluntarily providing important personal information.Protect yourself fromphishingby reviewing someexamples ofphishingemailsand learning more about this common online scam.
What is phishing?
Phishing is a cybercrime that aims to steal your sensitive information. Scammers disguise themselves as major corporations or other trustworthy entities to trick you into willingly providing information like website login credentials or, even worse, your credit card number.
What is aphishingemail/text message?
Aphishingemail or text (also known asSMiShing) is a fraudulent message made to look legitimate, and typically asks you to provide sensitive personal information in various ways. If you don’t look carefully at the emails or texts, however, you might not be able to tell the difference between a regular message and aphishingmessage. Scammers work hard to makephishingmessages closely resemble emails and texts sent by trusted companies, which is why you need to be cautious when you open these messages and click the links they contain.
How do you spot a phishing message?
Phishingscammers often undo their own plans by making simple mistakes that are easy to spot once you know how to recognize them. Check for the following signs ofphishingevery time you open an email or text:
It’s poorly written
Even the biggest companies sometimes make minor errors in their communications. Phishingmessages often contain grammatical errors, spelling mistakes, and other blatant errors that major corporations wouldn’t make. If you see multiple, glaring grammatical errors in an email or text that asks for your personal information, you might be a target of a phishing scam.
The logo doesn’t look right
To enhance their edibility,phishingscammers often steal the logos of who they’re impersonating. In many cases, however, they don’t steal corporate logos correctly. The logo in aphishingemail or text might have the wrong aspect ratio or low-resolution. If you have to squint to make out the logo in a message, the chances are that it’s phishing.
The URL doesn’t match
Phishing always centers around links that you’re supposed to click. Here are a few ways to check whether a link someone sent you is legitimate:
- Hover over the link in the email to display its URL. Oftentimes, phishing URLs contain misspellings, which is a common sign of phishing. Hovering over the link will allow you to see a link preview. If the URL looks suspicious, don’t interact with it and delete the message altogether.
- Right-click the link, copy it, and paste the URL into a word processor. This will allow you to examine the link thoroughly for grammatical or spelling errors without being directed to the potentially malicious webpage.
- Check the URL of a link on mobile devices by pressing and holding it with your finger.
If the URL you discover doesn’t match up with the entity that supposedly sent you the message, you probably received aphishingemail.
Types ofphishingemails and texts
Phishingmessages come in all shapes and sizes, but there are a few types ofphishingemails and texts that are more common than others. Let’s review some examples of the most frequently sentphishingscams:
Account suspended scam
Some phishing emails appear to notify you that your bank temporarily suspended your account due to unusual activity. If you receive an account suspension email from a bank that you haven’t opened an account with, delete it immediately, and don’t look back. Suspended account phishing emails from banks you do business with, however, are harder to spot. Use the methods we listed above to check the email’s integrity, and if all else fails, contact your bank directly instead of opening any links within the email you received.
Two-factor authentication scam
Two-factor authentication (2FA) has become common, so you’re probably used to receiving emails that ask you to confirm your login information with six-digit numerical codes. Phishing scammers also know how standard 2FA has become, and they could take advantage of this service that’s supposed toprotect your identity. If you receive an email asking you to log in to an account to confirm your identity, use the criteria we listed above to verify the message’s authenticity. Be especially wary if someone asks you to provide 2FA for an account you haven’t accessed for a while.
Tax refund scam
We all know how importanttax seasonis. That’s what phishing scammers are counting on when they send you phony IRS refund emails. Be careful when an email informs you that you’ve received a windfall of cash and be especially dubious of emails that the IRS supposedly sent since this government agency only contacts taxpayers via snail mail.Tax refundphishingscamscan do serious harm since they usually ask for your social security number as well as your bank account information.
Order confirmation scam
Sometimes, cybercriminals will try to tick you by sending emails with fake order confirmations. These messages often contain “receipts” attached to the email or links claiming to contain more information on your order. However, criminals often use these attachments and links to spread malware to the victim’s device.
Phishing at work
You need to be wary of phishing when you’re using your work email as well. One popular phishing scam involves emails designed to look like someone in the C-suite of your company sent them. They ask workers to wire funds to supposed clients, but this cash actually goes to scammers. Use the tips we listed above to spot these phony emails.
When phishing flies under the radar
Often, hackers look for ways to update old schemes so that they go undetected by users already aware of certain cyberthreats. Such is the case with thelatest phishing evasion technique, which detects virtual machines to fly under the radar. Cybersecurity firms often use headless devices or virtual machines (a computer file that behaves like an actual computer) to determine if a website is actually a phishing page. But now, some phishing kits contain JavaScript — a programming language that allows you to implement complex features on web pages — that checks whether a virtual machine is analyzing the page. If it detects any analysis attempts, the phishing kit will show a blank page instead of the phishing page, allowing the scam to evade detection. To help ensure that you don’t fall for the latest phishing scams, stay updated on the most recent phishing techniques so you can stay one step ahead of cybercriminals.
What happens if you click a link in aphishingemail?
Never click links in suspicious emails. If you click a link you suspect a phishing scammer sent, the link will take you to a web page with a form where you can enter sensitive data such as your Social Security number, credit card information, or login credentials. Do not enter any data on this page.
What do you do if you suspect you’ve been phished?
If you accidentally enter data in a webpage linked to a suspicious email, perform afull malware scanon your device. Once the scan is complete, backup all of your files and change your passwords. Even if you only provided a phishing scammer with the data from one account, you may have also opened the door to other personal data, so it’s important to change all the passwords you use online in the wake of a suspected phishing attack.
How to recognize a phishing email: simple tips
Let’s wrap things up with some summarized tips on how to avoidphishingemails:
- When in doubt, directly contact the organization that supposedly emailed you instead of opening links included in suspicious emails.
- Examine suspicious emails carefully to check for telltale signs of phishing, such as poor grammar, grainy logos, or bogus links.
- If you accidentally click aphishinglink, don’t enter any data, and close the page.
- If you think phishing scammers are targeting you, run a virus scan, backup your files, and change all your passwords.
Stay protected
Phishing emails only work on the unaware. Now that you know how to spot phishing emails and what to do if you suspect scammers are targeting you, you’re far less likely to fall for these schemes. Remember to be careful with your personal information when you use the internet and err on the side of caution whenever anybody asks you to divulge sensitive details about your identity, finances, or login information.
