Blog How to Identify, Prevent and Avoid Phishing Attacks

Is it possible to recognize and avoid phishing attacks?

Yes, it is.

This article explains some common ways phishers can attack you and how you can outsmart them. Read on to know how to recognize and avoid phishing scams.

How to Identify and Avoid Phishing Attacks

Scammers launch thousands of phishing attacks every day. To avoid becoming a victim, learn how to identify common red flags and avoid phishing attacks – and take action! But first, review the email. Is it genuine or fake? Legitimate or spammy?

Review the Email

You can also avoid phishing by reviewing the first point of contact the scammers have with you – the email.

Some things to look out for:

• The message looks like it is from a legitimate organization but comes from a public email domain like gmail.com 

• The email address contains weird characters in addition to a genuine company’s name

• The domain name is misspelled, e.g. john@grnedical.com instead of john@grmedical.com

• The logo looks a bit “off” in terms of design, placement, colours etc.

• The email text contains grammatical or spelling errors mistakes and a generic or foreign greeting like “Hi”

• It includes suspicious attachments or links

• The message creates a sense of urgency or panic

How to avoid phishing: No legitimate organization will send emails from public domains like Gmail or Yahoo, so never click on links within them or open their attachments. The same goes for all the other red flags listed above. Also, inform the IT team about the email so they can take any necessary action. Finally, never open emails from unknown senders, even if they appear genuine or legitimate organizations.

Pay Attention to Red Flags

Often, hackers run phishing scams by creating fake versions of legitimate websites. The victim doesn’t know that the website is fake or doesn’t belong to the government, bank or tax agency they trust. The purpose of the fake website is to trick the victim into sharing their sensitive information( i.e., account credentials, financial information) which the threat actor can leverage for malicious purposes.

You can avoid phishing scams by paying attention to key factors that may indicate that the site is fake. For example, if the site is a login page, ask yourself these questions:

• Does the formatting look weird?

• Are there glaring misalignment issues, say, between text boxes and their labels?

• Is there text on the page that makes no sense?

• Are there banners that don’t seem to belong on the site or to the brand?

How to avoid phishing: If you’re not sure that the site is fake, completely reload the page. If it still doesn’t look right, close it, and inform the IT team.

Check the Browser URL

The address bar can help you avoid phishing attacks. Look carefully at the website URL and domain. Look out for these issues:

• The URL doesn’t match the context of the rest of the email: For instance, an email from “Netflix” contains a link that takes you to: http://interweb27.com/membershipkey=123465

• The domain portion is obscured, so you see something like http://X8el87.netflix.com or https://netflix.replica.com

• The site throws up a “security certificate expired” message: This happens with genuine sites as well, but if it appears in combination with one of the two issues above – it’s a fake email

How to avoid phishing: Always check where links go before opening them. On a computer, hover your mouse over the link, and check the destination address that appears at the bottom of the browser. On a mobile device, hold down on the link and check the link that appears in the pop-up.

To Truly Avoid Phishing, Take Action! Get Expert Help

Phishing scams have become so common that it only takes one mistake by one employee to risk your entire organization. That’s why, to avoid phishing, you must implement strong security controls like:

• Modern browsers with built-in protection against fraudulent sites

• Updated antivirus, spam filters, web filters and firewalls

• Patched software

• Password managers

• Multi-factor authentication, and

• Strong EDR, SIEM and AI-based tools

One of the best ways to avoid phishing is to work with security experts who understand your business and its phishing risk profile. A security expert will design a customized program to protect your organization with simulated phishing penetration testing, employee awareness, etc. Talk to Packetlabs for more information.