Yes, I intentionally mis-spelled the word “fishy”, but for a reason!

Today’s topic: Phishing scams, and how you can avoid falling victim.

What is “phishing”? Phishing is a term used to try to get very sensitive information out of someone, one way or another. This is a crude form of social engineering. In most cases, you’ll receive some form of communication, be it Email, Text Message, phone call or even chat/instant message, containing the following:

Something is wrong with your account and it needs to be “verified”
Your account has been locked and/or disabled, and that you need to “log in” to restore it (!)
Your bank account needs to be confirmed (!!)
A document that requires a login to view (NOTE: Not all of these are fake! If you know the contact that sent the document, call them and ask, don’t reply to the email! I’ll explain why in a moment.)
Your account was used to make a fraudulent purchase (!!!!)
An attachment that you were not expecting.

Friends, these messages are purely fake. Their purpose is to trick you into giving up sensitive information, usually in the way of access to sensitive accounts (Bank, email, etc). With updated security measures, such as 2-Factor Authentication, Phishing attacks have also gotten more sophisticated. Some scammers will try to take over your accounts through recovery methods, such as sending you a code. If they DO send you a code, DO NOT GIVE IT TO THEM! Once you give them this code, they’re in, and you’re out of luck.

DID YOU KNOW: Phishing is the number one cause of data breaches on the internet today!

Know the warning signs: Know what to look for if you suspect you may be getting phished, and how to thwart the attempt:

An email that you recognize the source of, but is marked as SPAM, UNSAFE or DANGEROUS: This is the most common sign. This happens when the email comes in using say, a colleague’s email address, but it originated from an email server outside of the email domain. (It is common for scammers to take advantage of exploited or misconfigured email servers). If in doubt, CALL the colleague and ask them if they sent it, do NOT respond to the email, as it is possible that the colleague’s email account has been compromised.
Phone calls from what appears to be your carrier, service provider or other company you work with, but the person on the other end is requesting access to your account: This is one of the cheapest scams, and if you fall for it, At best, they just take over that service account. At worst, they’ll use this as a gateway to take over more sensitive accounts. These people use VoIP services that allow them to spoof (fake) the phone number they’re calling from. Often times, they will use the main number for the service. If in doubt, just hang up and call the REAL number. If you got far enough that they are in your service account, you can call the provider and they can help you kick them out.
Emails with attachments that you’re not expecting: Did “Jan” over in accounting just send you the monthly budget report? You download the attached Excel spreadsheet, and open it. It wants to run Macros, so you let it. OOPS! You just got nailed with ransomware! You now realize that it wasn’t Jan that sent you that attachment, but a hacker pretending to be Jan. If your company email system is set up right, it should be able to catch these and either mark them as external, block access to, or remove the dirty attachment. When in doubt, call the sender and ask if they sent you a file. If they did NOT send anything, delete the email.
Texts with random 2FA codes or other account recovery methods: This is someone trying to get into your account, and is usually paired with a phone call from a scammer. Unless you are requesting a login code for one of your accounts, Just delete the message. If it comes up in one of your apps, and you did NOT initiate the request, reject it. Allowing it will grant access to whoever is trying to get in. If you DO get this sort of request, Assume your password has been compromised (Think of 2FA as the second line of defense). Go ahead and change your password ASAP.
Emails/texts/DMs asking you to “confirm” your account: Another weak attempt at accessing your accounts. The only course of action here is to simply delete the message. Many times these will contain a clickable/tappable link that will take you to what LOOKS like a service’s proper log in page, however, when you put your username and password in here…….It’s not getting sent to the service, but rather to a storage server controlled by the attacker. If you have 2FA set up, you shouldn’t have to worry here, but definitely change your password should you get tricked into this.
Emails/Texts containing password reset requests: An even weaker method of gaining access. Unless YOU requested the reset, just delete and ignore these messages! If you acknowledge them, you’re basically letting an outside attacker into your account. This is like letting someone into your house, only for them to kick you out and change the locks. Once they get in, they will change your password, recovery information AND log out ALL open sessions. Kiss THAT account goodbye!

NOTE: No service provider, carrier or other company is EVER going to ask you for your login information or to “confirm” your account. They can usually access your account from their internal systems. Bear in mind though, they MAY ask you for a code to confirm you’re the account holder (If you have that security layer set up), which in this case, is fine to give, but be sure you have called your company’s actual customer service!

Okay, now that you know about some of the basics of phishing, and how to avoid getting hooked, Let’s test out that new found knowledge, shall we?

Phishing Quiz
Time to test your knowledge! Will you fall for the bait, or will you outsmart the phisherman?

1 / 6
Someone from Verizon calls you saying that someone used your account to purchase an iPad in another state. The phone number that comes up on the Caller ID is their proper number, 800-922-0204. What do you do?
A. Let this rep help you stop the purchase.
B. Hang up and call the 800 number to confirm
C. Start giving them random facts about cats

Errr………Either you think this is really happening, or you really really like to talk about cats (This part is good!) The proper answer here is B. Just hang up, and call back at the official 800 number to speak to a REAL rep.
(C is also a good answer if you’re bored enough. Wasting a scammer’s time can be loads of fun!)
Correct! This is a common scam to get you to give access not only to your Verizon account, but in many cases, your actual EMail account! Just dump the call, and call back on the official 800 number to talk to a REAL Verizon rep! Trust me, they will also tell you that this is a scam.
I also condone C here, if you’re bored enough. Doesn’t accomplish much of anything other than wasting the scammer’s time, which keeps him from scamming someone else, Plus, cats are awesome!
2 / 6
You get an email from Don in HR. The email contains an attached Word document. You call Don up, and he says he did NOT send you the attachment. What do you do?
A. Open the attachment in the email
B. Delete the email
C. Forward this email to others

Whoa there! You checked with Don on this and he says he DID NOT send this email, so why would you open the attachment? Even more, why would you pass it on to someone else? Either you must really hate your job, your coworker, or you’re just oddly curious about the attachment. Dump the email and inform your IT about the incident.
Correct! Don verified he did not send this to you, so why would you want to open the attached file? That can lead to some bad juju. Putting this thing in the trash is the righteous thing to do!
3 / 6
You call Comcast on their official 800 number for assistance with your services. During the course of the call, the rep sends a code to your phone or email that they ask you to provide to them. What do you do?
A. Hang up
B. Ask why the need the code
C. Locate and provide the code

Well, Clearly you called Comcast for help with something, so why would you ask them why they need a code that they sent you? Hanging up is just as silly. Now if you just googled for their number and called the first one you saw, this may be plausible, but the reps DO have to access your account to perform any service for you. Just provide the code.
Correct! Just be absolutely sure you REALLY called Comcast (You can find the proper support line numbers on your monthly bill). Provide the Comcast rep with the code, and get the assistance you called in for.
4 / 6
You get a text message out of nowhere with a password reset link in it. You do not recall requesting a password reset on anything. What do you do?
A. Delete the message
B. Forward the message
C. Click/tap the link and follow the directions

Umm…….You got sent a password reset that you didn’t start, and you want to finish it? Well, in SOME cases, this may not be a totally bad thing, as it can serve as a reminder for you to rotate your passwords periodically. Don’t use the password reset to do this though, as some will generate and send a new password, while others will make you set one yourself. Go to the affected site yourself and reset your password there. Check your other accounts while you’re at it.
Why would you forward a password reset to someone else? If you’re going to get hacked, At least do it yourself. Don’t make some other poor schmuck do it for you.
Correct! Just delete this message. It doesn’t hurt to go to the site that it came from, and update your password anyways. Always use a strong password!

5 / 6
You get an email from Karen in sales. The email contains an attached spreadsheet. What do you do?
A. Delete the email
B. Open the attachment
C. Call Karen and find out if she actually sent the email

Well, you COULD just open the attachment, but were you expecting it? Will this seemingly innocent attachment give me beautifully organized data, or will it unleash havoc on my network? You could also delete it blindly, but if she REALLY did send it, then asks you later if you got it, What are you going to say?
It’s best to CALL Karen and find out. Yes, you could just email, but what if her email account has been hijacked? Well, you’re just going to get confirmation from the hacker instead.
Correct! Call Karen and verify that she did send this document to you. You could email, but there is the chance that her email has been hijacked. Make your best decision from her verbal answer.
6 / 6
You get an email from Matt in shipping. The email contains a PDF file. You were not expecting this, so you Email matt and ask if he sent this file, and he says yes. What do you do?
A. Call Matt and ask if he sent you the attachment
B. Delete the email
C. Open the attachment

You checked with Matt, it’s cool, the attachment is OK! You open the PDF file. Awhile later, weird things start happening on your PC. You’re locked out of your email now, and people are calling you asking if you sent them that same file. IT is calling you as well asking what you did.
Call Matt and check. Don’t email. If he does confirm that he sent the file to you, then it’s likely alright.
Correct! Again, Verbally check with the sender, especially if you weren’t expecting it. You can also use internal messaging if it is independent of your email system. We really just want to make sure that he did indeed send this document.
Your score is
The average score is 0%
0%

(239) 939-5383

(239) 939-5383

Don’t get hooked, or This email smells phishy………

You Might Also Like

Cell phone companies HATE this 1 trick!

Connecting your productivity: The beginner’s guide to networking

Wifi woes killing your productivity? Find out why here! (And learn more about Wifi!)