Though cybercriminals are using increasingly sophisticated ways to steal sensitive data from companies and individual households, cybersecurity experts say there is one relatively simple way to thwart them: Don’t click on strange attachments or links.
Such fraudulent links and attachments in email and malicious websites are known as “phish,” and they’re designed to lure recipients into providing sensitive information that helps cyber criminals gain access to systems and networks. A phish typically infects a machine with malware and viruses to collect personal and financial information, and they’re often successful because they appear to be sent by a person or organization the recipient knows. Phishing emails and links may appear to come from a real financial institution, e-commerce site, government agency, or any other service, business, or individual. A phish typically requests personal information, such as account numbers, passwords, or Social Security numbers.
These are common ploys:
Prompting a message recipient to provide a user name and/or password. No one at Cardan Capital Partners or from any of our financial services partners ever will ask you for your user name and/or password in an email — or over the phone.
Convincing a recipient to make a purchase or send money as requested in an email without confirming the sender actually made the request. Phish attacks can be sophisticated enough to show a sender’s name you may recognize. However, if a request by email seems out of the ordinary, do not reply to it directly. Call the person to confirm the request.
Convincing the recipient to enter an email address in conjunction with a retail site or social media network. To help guard your sensitive information and protect your employer’s networks, think twice before sharing an email address with any third party, cybersecurity experts say.
Five tips to avoid being hooked by a phish
These tips to stronger data security are from the National Cybersecurity and Infrastructure Security Agency:
Play hard to get with strangers. Links in email and online posts are often the way cybercriminals compromise your computer. If you’re unsure who an email is from — even if the details appear accurate — do not respond, and do not click on any links or attachments found in that email. Be cautious of generic greetings, such as “Hello Bank Customer,” because these are often signs of phishing attempts. If you are concerned about the legitimacy of an email, call the company directly.
Think before you act. Be wary of communications imploring you to act immediately. Many phishing emails attempt to create a sense of urgency, causing the recipient to fear their account or information is in jeopardy. If you receive a suspicious email appearing to be from someone you know, reach out to that person directly on a separate secure platform. If the email comes from an organization but still looks “phishy,” reach out to them via customer service to verify the communication.
Protect your personal information. If people contacting you have key details from your life — such as your job title, multiple email addresses, full name, and more that you may have published online somewhere — they can attempt a direct spear-phishing attack on you. Cyber criminals also can use social engineering with these details to try to manipulate you into skipping normal security protocols.
Be wary of hyperlinks. Avoid clicking on hyperlinks in emails, and hover over links to verify authenticity. Also ensure URLs begin with “https.” The “s” indicates encryption is enabled to protect users’ information.
Double your login protection. Enable multi-factor authentication (MFA) to ensure the only person who has access to your account is you. Use MFA for email, banking, social media and any other service that requires logging in. If MFA is an option, enable it by using a trusted mobile device, such as your smartphone, an authenticator app, or a secure token — a small physical device that can hook onto your key ring.
Shake up your password protocol. Consider using the longest password or passphrase permissible. Get creative and customize your standard password for different sites, which can prevent cyber criminals from gaining access to these accounts and protect you in the event of a breach. Consider using a password manager to generate and remember different, complex passwords for each of your accounts.
Install and update anti-virus software. Make sure all of your computers, Internet of Things devices, phones, and tablets are equipped with regularly updated antivirus software, firewalls, email filters, and anti-spyware.
Put your knowledge to the test
Can you spot scam emails? It is trickier than you might think. Google’s technology incubator, Jigsaw, has released a realistic and educational quiz you can find here to learn more about phish email attacks.
Disclaimer: The information provided is intended to increase security awareness and is not meant to be a complete discussion of cybersecurity. Cardan Capital Partners does not warrant the accuracy of any information contained in the links and neither endorses nor intends to promote the advertising of the resources listed herein. The opinions and statements contained in such resources are those of the vendors and do not necessarily represent the opinions of Cardan.