![\"\"](\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2019\/03\/gone-phishing-five-signs-that-identify-scam-email-messages.png\")
<\/p>\nA significant danger to businesses today is phishing<\/i>\u2014the act of forging email to fool someone into revealing login credentials, credit card numbers, or other sensitive information. Of course, scam email phishing is a problem for individuals too, but attackers more frequently target businesses for the same reason as bank robber Willie Sutton\u2019s apocryphal quote about why he robbed banks: \u201cBecause that\u2019s where the money is.\u201d<\/p>\n
The other reason that businesses are hit more often is that they have multiple points of entry\u2014an attacker doesn\u2019t need to go after a technically savvy CEO when they can get in by fooling a low-level employee in accounting. So company-wide training in identifying phishing attempts is absolutely essential.<\/p>\n
Here are some tips you can share about how to identify fraudulent scam email phishing messages. If you\u2019d like us to put together a comprehensive training plan for your company\u2019s employees, get in touch.<\/p>\n
The number one thing to watch out for is any email that asks you to do something that could reveal personal information, expose your login credentials, get you to sign a document online, or open an attachment that could install malware. Anytime you receive such a message out of the blue, get suspicious.<\/p>\n
<\/p>\n
If you think the message might be legitimate, confirm the request \u201cout of band,\u201d which means using another form of communication. For instance, if an email message asks you to log in to your bank account \u201cfor verification,\u201d call the bank using a phone number you get from its Web site, not one that\u2019s in the email message, and ask to speak to an account manager or someone in security.<\/p>\n
This is the email equivalent of \u201cstranger danger.\u201d If you don\u2019t know the sender of an email that\u2019s asking you do something out of the ordinary, treat it with suspicion (and don\u2019t do whatever it\u2019s asking!). Of course, that doesn\u2019t mean you should be entirely paranoid\u2014business involves contact with unknown people who might become customers or partners, after all\u2014but people who are new to you shouldn\u2019t be asking for anything unusual.<\/p>\n
![\"\"](\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2019\/03\/gone-phishing-five-signs-that-identify-scam-email-messages-1.png\")
<\/p>\n
Attackers often forge email so it appears to come from a big company like Apple, Google, or PayPal. These companies are fully aware of the problem, and they never send email asking you to log in to your account, update your credit card information, or the like. (If a company did need you to do something along these lines, it would provide manual instructions so you could be sure you weren\u2019t working on a forged Web site designed to steal your password.)<\/p>\n
![\"\"](\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2019\/03\/gone-phishing-five-signs-that-identify-scam-email-messages-2.png\")
<\/p>\n
Since sample email from large companies is easy to come by, these phishing attacks can look a lot like legitimate email. Aside from the unusual call to action, though, they often aren\u2019t quite right. If something seems off in an email from a big company, it probably is.<\/p>\n
![\"\"](\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2019\/03\/gone-phishing-five-signs-that-identify-scam-email-messages-3.png\")
<\/p>\n
The most dangerous form of this sort of attack is spear phishing,<\/i> where an attacker targets you personally. A spear phishing attack involves email forged to look like it\u2019s from a trusted source\u2014your boss, a co-worker, your bank, or a big customer. (The attacker might even have taken over the sender\u2019s account.) The email then requests that you do something that reveals sensitive information or worse. In one famous spear-phishing incident, employees of networking firm Ubiquiti Networks were fooled into wiring $46.7 million<\/a> to accounts controlled by the attackers.<\/p>\n Many phishing attacks come from overseas, and attackers from other countries seldom write English correctly. So no matter who a message purports to come from, or what it\u2019s asking you to do, if its spelling, grammar, and capitalization are atrocious, it\u2019s probably fraudulent. (This is yet another reason why it\u2019s important to write carefully when sending important email\u2014if you\u2019re sloppy, the recipient might think the message is fake.)<\/p>\n One of the best ways to train employees about the dangers of phishing is with security awareness testing, which involves sending your own phishing messages to employees and seeing who, if anyone, falls for it. Again, if you need help doing this, let us know.<\/p>\n![\"\"](\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2019\/03\/gone-phishing-five-signs-that-identify-scam-email-messages-4.png\")
<\/p>\nBeware of email that has numerous spelling and grammar mistakes<\/h3>\n
![\"\"](\"https:\/\/macworks.com\/blog\/wp-content\/uploads\/2019\/03\/gone-phishing-five-signs-that-identify-scam-email-messages-5.png\")
<\/p>\n