" phishing Archives - Page 3 of 5 - LuxSci

Posts Tagged ‘phishing’

What Is Smishing And How Can You Avoid It?

Tuesday, March 9th, 2021

You are probably familiar with smishing, even if you aren’t quite sure what it’s called or the underlying details. We’ve all received strange SMS messages along the lines of:

  • We’ve noticed suspicious activity on your account. Visit scamsiteabc.com/kkjdkjh if you did not make any recent purchases.
  • Congratulations! You’ve won a $500 Best Buy gift card. Click the link to redeem your prize scamsitexyz.com/ljhkjsfds

Of course, both of these messages are really just scams. They are a type of phishing conducted over SMS, hence the name Smishing. These smishing messages can look real—that’s the point. They are designed to trick the recipients into thinking that they are legitimate. They lead the recipients through a number of steps that ultimately result in them handing over sensitive details, such as their login details or banking information.

smishing title card

How Does Smishing Work?

Scammers collect a bunch of phone numbers and send out smishing messages in bulk to unwitting victims. These messages often appear to come from respected organizations, such as the recipient’s bank, or a major retailer. The exact details of the messages vary, but they generally try to elicit a quick response before the recipient has a chance to question it.

Common examples include offering prizes that may excite recipients or a warning that someone has attacked their account. The message prompts the recipient to take some immediate action. These actions can include:

  • Clicking a link – This is probably the most common example. These links will take you to a website that looks legitimate, but the details will be slightly wrong. For example, instead of the real URL, yourbank.com, the scam site may actually be yourbamk.com. At a glance it looks the same, but the scam site has no relation to your bank.
  • Contact an email address – Much like in the above example, the address can seem real, but it may have subtle differences, such as customerservice@yourbamk.com, instead of customerservice@yourbank.com.
  • Call a phone number – The number will not actually belong to the company, but a scammer impersonating the organization’s call center.

When these messages succeed and trick the recipients into taking the next step, they will be funneled deeper along in the attack. The recipient may be pushed to download malware onto their device, which can end up spying on them and stealing their sensitive information.

The other main tactic is to manipulate recipients into handing over their login details or banking information. One technique is to fake a security breach and have users re-enter their password on a fake login page. Just like that, scammers can take control of your account.

Other tactics include asking the recipient to update their account details, or to confirm their security questions and answers. This can ultimately give attackers the information they need to take control of the account.

Smishing is used to directly target individuals, or as an attack vector for penetrating deeper into an organization. If a smishing attack fools an employee, it can give these scammers access to the company’s systems. From this foothold, they can escalate their privileges until they reach their ultimate goal. This could be stealing valuable data or even accessing the company’s finances.

How Can You Avoid Smishing?

Individuals can avoid smishing by always being skeptical of text messages that ask them to visit a link, to email someone, or to call a number. They should use caution if they do not know the sender, or if the message sounds too good to be true.

Recipients should always double check the URLs, email addresses, and phone numbers to make sure that they belong to the company. You can check your prior correspondence with the company, or do a web search of the details alongside the company name to confirm. Compare the details in the smishing message against the official ones from the company, making sure to look closely for misspellings.

You can also check potential phishing sites against this database to see if it has already been reported. If you can confirm it is a smishing message, all you have to do is ignore it to stay safe. Do not even click the link, because it could infect your device. If you aren’t sure, contact the company via its official channels to check whether or not it is a scam.

Many companies have a blanket policy that they will never contact you by text asking you to update your account. If this is the case and you receive such a message, you can easily disregard it as a scam.

How Can You Defend Your Customers From Smishing?

If your company would like to be able to send URLs in its text messages without also opening the door to scammers, you can use a service like LuxSci’s SecureText. You can alert your customers that the only text messages you send will take them to the SecureText portal. As long as they check that the URL for the portal is correct, they will be safe to click the link. They can disregard any other messages purporting to be from your organization, because these will be scams.

From the SecureText portal, the recipient can enter their details to gain access to the message. The protective features of LuxSci’s SecureText allow organizations to send sensitive information via SMS, all in a HIPAA-compliant manner. With SecureText and a proper warning strategy, you can help protect your recipients from being tricked by smishing scams that seem to come from your organization.

It’s Tax Season – Watch Out or You’ll Be Paying More than Just Taxes

Thursday, March 14th, 2019

The season is upon us. It’s definitely not Christmas, and there are very few people who would claim that the lead-up to April’s cutoff date is their favorite time of the year. If you thought that paying your dues to the IRS was already enough to worry about, get ready for some bad news:

It’s also scam season.

To celebrate the rising number of fraud and identity theft attempts, the helpful folk at everyone’s favorite government department have just begun their annual ‘Dirty Dozen’ campaign, listing the biggest tax scams that people need to be aware of.

Phishing Is Still King

The first entry on this year’s list is the ever-pervasive phishing scam. The IRS press release warns that phishing attacks “tend to increase during tax season and remain a major danger of identity theft.”

These phishing schemes can take many forms in their attempts to extract sensitive information (such as login credentials or credit card details) from targets. At this time of year, many attackers take advantage of the confusion and target their victims with tax-related scams.

“Taxpayers should be on constant guard for these phishing schemes, which can be tricky and cleverly disguised to look like it’s the IRS,” said IRS Commissioner Chuck Rettig in the press release.

“Watch out for emails and other scams posing as the IRS, promising a big refund or personally threatening people. Don’t open attachments and click on links in emails. Don’t fall victim to phishing or other common scams.”

Organizations Are Being Targeted As Well

It’s not just the individual who is being directly targeted either. Over time, a series of more sophisticated scams have evolved. One of these is known as business email spoofing (BES), which involves attackers sending convincing emails from a faked address.

Another is called business email compromise (BEC), which involves a hacker stealing the credentials of a target’s email account, then sending emails from that account to other victims, impersonating the account’s owner to manipulate these new victims into divulging information or transferring money.

The IRS also states that it is seeing a greater number of advanced scams that target the files of human resources personnel, tax professionals and other organizations. These targets tend to have extensive amounts of their client’s financial information, which hackers chase after in a number of different ways.

The hackers may pose as an employee and ask for a deposit to be rerouted to another account, act as a business and ask their target to pay a fraudulent invoice, or even pretend to be one of the victim’s associates and trick the victim into transferring money into the hacker’s account.

Due to the growing sophistication of these scams and their proliferation at this time of year, the IRS has warned tax professionals to be on high alert for any suspicious or unusual activity.

Keeping Yourself, Your Organization or Your Clients Safe

As part of the IRS’s campaign on combating identity fraud, it launched the Security Summit, a conference of various stakeholders aimed at coming up with solutions and mitigation strategies.

Some of the summit’s recommendations include raising awareness about spear phishing and how to recognize it, encrypting all sensitive client data and implementing strong password strategies.

If you or your organization come across any phishing attempts that impersonate the IRS or related organizations, you should report the scam to phishing@irs.gov.

How to Know if an Email is a Phishing Scam or Not

Tuesday, November 20th, 2018

Phishing scams are a major threat to all email users, especially businesses. The scary part is that they are becoming increasingly sophisticated. Phishing emails popped up sometime in the early 90s. However, back then, they weren’t too hard to detect. For instance, typos were commonplace in old-school phishing mail, which was a dead giveaway.

Of course, this was long ago, when email was still in its infancy. Times have changed, and today’s cybercriminal has changed with the times. Their tactics have evolved, and phishing emails are far more convincing than they used to be. They are well-written and personalized. Hackers and cybercriminals already have a rough idea of who you are, which means today’s phishing emails are targeted.

Today’s phishing emails also look authentic; they replicate the design and aesthetics of legitimate emails. In fact, at first glance, you wouldn’t know the difference between an actual email from your bank and a fraudulent version. This makes fighting phishing scams a significant challenge.

On the rise

According to data from the RSA, phishing attacks are only growing, despite an increase in user awareness. One primary reason for this growth is the simplicity of executing such scams. Malware developers now offer automated toolkits that scammers can use to create and host phishing pages with the utmost ease.

It is estimated that each phishing attack manages to extract an average of $4500 in stolen funds.

So, the big question is – how does one protect their email, especially when phishing scams are evolving? Well, here is what the experts have to say.

Never trust just a name

 A common tactic scammers use is spoofing the display name in an email. According to a study done by ReturnPath, around 50% of 760,000 email threats targeting some of the world’s biggest businesses used this tactic.

This is how it works – let’s say a scammer spoofs a brand name such as “Nike.” The sender’s email address may look something like “Nike nike@customersupport.com.” But, even if Nike doesn’t own the domain “customersupport.com,” DMARC and other email authenticity and anti-fraud tools will not block the mail. This is because the email is legitimately from customersupport.com, even though this domain has nothing to do with Nike. There is no authentication for the “comment” that goes along with the email address (in this example, that is the word “Nike”).

Read the rest of this post »

Best Practices for Minimizing the Impact of Social Engineering on Your Organization

Tuesday, June 26th, 2018

When many people think of cybercrime, they think of a bearded guy tapping away at his keyboard in a dark room, searching for vulnerabilities in the network that can be exploited. While exploits are a significant threat, the reality is that many attacks happen in smoother and more subtle ways. Why spend days trying to get in the backdoor when an attacker can ask nicely to be let in through the front? This is the essence of social engineering.

A social engineer uses many tactics to manipulate victims into giving up whatever information they need. Imagine someone with a police uniform knocks on your door and asks for a word. They look authoritative, so you invite them in to sit down. They spend five minutes discussing crime in the neighborhood, and on the way out, they secretly swipe the spare key. A few days later, you return home to discover that all your valuables are gone.

In this case, the social engineer tricked their way into the home by using a police uniform to appear authoritative. Most people won’t think to turn down a police officer’s request or ask for further identification. The attacker took advantage of this to gain access to the house, where they could get what they wanted, the spare key.

Read the rest of this post »

SPF and DKIM: The State of Domain-based Email Authentication – Part 1

Friday, September 1st, 2017

Recent reports on cyber-security threats in the healthcare sector by Verizon, Symantec and Ponemon consistently make several observations:

  • Email-borne malware is on the rise, with such malware delivered via spam or phishing;
  • Small-to-medium sized businesses (from all sectors) have the highest rate of email-delivered malware;
  • Most breaches are caused by negligent employees or contractors.

These conclusions are hardly surprising as email is now an increasingly common part of communications with protected health information (PHI) frequently exchanged amongst employees and patients within a practice, between medical providers, and medical providers and their business associates. The concern for the healthcare industry is the potential violation of the HIPAA privacy rule caused by email-related (and other) breaches, leading to disruptions from loss of data, compliance audits and possibly hefty fines.

No Phishing

We wrote about obvious measures medical providers can take to avoid HIPAA non-compliance in email exchanges such as opt-out email security. That addresses only one aspect of the threat landscape, though – the protection of PHI in email exchanges. Another aspect is more sinister, as it deals with external, malignant actors. These actors use various spoofing techniques to trick patients or employees of a medical practice to react incautiously, often impulsively, to emails supposedly coming from valid sources. These often lead to identity theft, where the damage is more far-reaching as the information given up is more long-lived and more widely used and cannot just be erased like revoking a misused credit card.

Read the rest of this post »