How to spot phishing emails and other malicious content
Small and large business alike have the same risk when it comes to employees. Teaching staff how to spot bad emails and what to do is critical to modern security. In this article Tetrabyte Managed IT Support share our top tips on spotting emails you should delete.
Check the Sender’s Email Address – Not Just the Display Name
The display name is not always reflective of the sender, Cyber Criminals can set the display name to anything they like. Email addresses can also contain minor misspellings to mislead users, @micros0ft.com is not the same as @microsoft.com. Its possible to spoof the sender email as well, but these are far more likely to be delivered direct to your junk mail!
TIP: Hover or click on senders name to reveal the email, check the spelling carefully.
Check links before clicking
Links may not always go where they say they will, they can also hide behind really long domain names to cover their actual origins.
Check the link closely, look for the first ‘/’ in the path and work backwards from that, behind that you’ll see the ‘Top Level Domain’ Name (TLD), e.g. ‘.com’, ‘.co.uk’, ‘.org’, ‘.in’, ‘.ru’ etc.
Then behind that, look for the domain name, its everything after the previous ‘.’ E.g. learn.Microsoft.com, voice.tbyte.com, www.remoteit.co.uk.
This forms the sites main domain name, which is what your looking for. Don’t get fooled by domain names like microsoft-online-services-login-portal.doge.ru the core domain for this is .doge.ru and has nothing to do with Microsoft. The extended ‘SubDomain’ attempts to fool you into ignoring the actual domain name.
TIP: Carefully hover over links and inspect the destination, if in doubt, just open your web browser and visit the site directly.
Watch out for Emotional Manipulation
Cyber criminals try to push you to act fast and prevent you from thinking about the issues and options. Word and phrases may include items like ‘Critical’, ‘Urgent’, ‘Account will be suspended’ or ‘Payment complete’. These are all designed to make you panic and act without proper thought. If in doubt, ALWAYS contact your IT Support team, they will be trained to evaluate such content and have context to how systems are setup.
TIP: Never panic over an email, by default email is not a method of communicating urgent information.
If you’re asked to keep it a secret, it’s a big red flag!
Any messages telling you not to speak to other staff, especially management should raise a red flag. Cyber criminals don’t want you getting a second opinion, but this should normally be an option for most requests. If the request does feel legitimately confidential, you can always use another contact method such as phone to check in with the requester and validate the legitimacy. (Don’t double check by reply email as a users account could be compromised)
TIP: Double check with other staff via phone or in person if you have any doubts.
The unexpected email!
Most emails asking you to action something should be mildly expected. Did you actually request a password reset? Would you manager normally ask you to do that? If this a project you’re working on? Would such requests normally come from someone else?
TIP: Be careful about actioning items that you didn’t expect to have to deal with.
Be very careful with attachments
Attachments add a layer of complexity to email security, they are harder to scan, harder to check and cyber criminals exploit this to try to bypass security.
Ask yourself key questions with every attachment:
• Were you expecting this person to send you an attachment?
• Does the file type make sense, e.g. pdf, xlsx, docx be careful of macro enabled files xlsm, docm these contain programmable code.
And the BIG RED FLAG – Attachments should never ask you to enter login details. That’s a core phishing technique.
TIP: Be careful with attachments, they are commonly used to bypass security scanning.
What more can we do:
• Multi-Factor Authentication should be enabled on all systems and enforced for all users.
• Email filtering systems can provide additional protection
• Cyber Security Training for all staff can be a cheap and effective way of reducing risks
• Extending basic antivirus to fully monitored Endpoint Protection solutions provides a key line of defence against bad actors online.
Contact Tetrabyte to discuss your options and take the next steps now.
Call us today on 0330 900 1066 for a no pressure, no obligation quote.
