“Lions and tigers and bears, oh my!” Many of you might remember the famed quote Dorothy exclaimed in the Wizard of Oz. You probably also remember the copious perils she and her new friends faced on their quest to get Dorothy back to Kansas. In real life, equally menacing dangers stalk businesses and individuals. Of course, the threats aren’t flying monkeys or green witches. They’re in the form of phishing, vishing, and smishing—oh my!
In today’s connected world, the elusive, unseen bad guys don’t threaten our physical well-being, like Dorothy’s pursuers. Instead, they endanger the data, identities, and livelihoods of individuals and corporations. They do this through cunning, covert techniques designed to trick people into giving up identifying and sensitive personal or company information.
Let’s look at three common methods cybercriminals employ to gain important data from another person or business.
Phishing is probably the best-known and most successful attack method. How does it work?
A cybercriminal will send fraudulent emails with malicious attachments or links. The emails are designed to look authentic, often seemingly from an already well-known organization that would elicit trust from the recipient—like a bank, large retailer, or email provider. The emails typically contain an urgency and motivation for the reader to click a link or download an attachment. After clicking, they will be asked to provide sensitive or identifying information, such as login credentials to a bank account, corporate network, or any other account that requires a username and password.
Examples of phishing email language include:
Once the unsuspecting recipient provides the requested information, their account or network is compromised. The bad actor now has access. He can use the credentials to log in and steal money, access sensitive data, or conduct any business the valid owner of the account would be able to.
Cybercriminals do their best to create emails that appear legitimate, using copied business logos, expertly designed images, and persuasive language. And they fool many people. But there are ways you can recognize phishing emails and avoid falling into their trap.
Vishing criminals have the same motivation as phishing villains, except they use phone calls instead of emails. A recent study revealed that 28% of respondents have received a vishing call. These bad actors use the same scare tactics and urgency, saying things such as:
Smishing’s popularity is growing. And as the name suggests, smishing is very similar to both phishing and vishing. The method of delivery for smishing is through SMS messaging (text). Attacks come in the form of a text message that could look like it is either from a person you know, an institute you conduct business with, or an unknown entity. Smishing messages either send a link for you to click so they can then potentially install ransomware, spyware, or other types of nefarious software on your device. And just like phishing emails, smishing texts can send a link that leads to a site intended to steal your personal information.
Security training and education are the number one defenses against these attacks. Organizations should provide employees with annual cybersecurity training and documented best practices guidelines—over 32% of employees are prone to phishing attacks. Training should be well rounded, including in-depth phishing, smishing, and vishing content, as well as ransomware and other methods today’s cyber criminals employ. Employers should take heed, as only 28% of respondents feel that they’ve been trained sufficiently in cybersecurity.
Individuals can research online, help educate friends and family, and inform others when they learn of new or evolving threats.
Cyberattacks become more sophisticated and challenging to recognize as criminals hone their craft. Yet even with this evolution, bad actors carry on with standard techniques that continue to hook victims.
To fight back against cybercriminals, learn their methods, stay up to date on new techniques, and remain aware and cautious. The better prepared you are to spot the dangers that cyber criminals pose, the less likely you will fall victim.
Phishing and Vishing and Smishing—No more.
Print and post around your office, or share electronically with your colleagues. We are all part of the "human firewall."