The days of crude phishing attacks, which anyone with a little common sense could avoid falling victim to, are a thing of the past. Today’s cybercriminals are savvier than their predecessors, capable of producing spoof emails and websites convincing enough to fool even the most educated eye.
While it’s easy to feel helpless in the wake of these advances, there are still steps that ordinary internet and email users can take to avoid falling victim to phishing attacks.
The state of phishing
While cybercriminals have an array of tactics at their disposal, phishing remains a firm favourite. Unlike other forms of cyber-attack, most of the work is done by the victim. With a little bit of code and some design savvy, a cyber-criminal can gain instant access to a victim’s bank account. If the account they gain access to happens to belong to a successful business, so much the better.
Most people also aren’t aware that they’ve fallen victim to a phishing attack until it’s way too late, with some companies taking up to five months to realise they’ve been phished.
The 2018 Trustwave Global Security Report (quoted here) shows that phishing was the leading cause of attack (55%) in corporate network environments, followed by malicious insiders (13%) and remote access (9%).
These attacks also come at a massive cost to the companies who fall victim to them. In the UK, the total organisational cost of a data breach in 2017 was £2.48 million. In the US, meanwhile, FBI statistics show that phishing attacks cost American businesses at least US$500 000 000 per year.
Increasing sophistication
Given the cost, it’s critical that businesses and ordinary users alike stay abreast with the latest phishing techniques.
Unfortunately, as these techniques become more sophisticated, that’s become more challenging to do.
Cybercriminals can realistically spoof email addresses and URLs, eliminating what were once two tell-tale signs of phishing.
Perhaps more worryingly, they can also spoof the look and feel of emails and websites more convincingly than ever.
On opening an email from a phishing scammer, there is often little to suggest that it doesn’t come from the organisation it’s spoofing (your bank, for example). Nothing looks out of place or obviously distinguishes it from any other communication sent out by the organisation. If you happen to be a customer of that organisation, you’d be easily forgiven for falling victim to the scam.
The same is true for almost all financial institutions, which are often the primary targets of phishing attacks.
While email service providers, digital security companies, and corporate security teams alike are all working on combating phishing, they’re in an arms race with the cybercriminals. No matter what technological solutions they come up with, however, human beings remain the greatest point of vulnerability.
Staying safe
Knowing this, what chance do ordinary email users have of staying safe? And, crucially, what can financial institutions and other companies do to help keep their customers safe?
From a user perspective, there are still oddities to look out for, especially once you go beyond the branding. Does the email include an attachment? If the attachment has a certain file extension (.html, .exe or .bat for example) you shouldn’t open it under any circumstances.
Businesses sending emails to their customers, meanwhile, should focus on education. Not only do they need to keep their customers up to date with the latest messaging used in phishing attacks, but they also need to remind customers what they’ll never ask them to do in an email.
Importantly, this kind of education needs to be ongoing and be communicated across multiple channels. Remember, that occasional messaging is soon forgotten and people can quickly slip back into old habits. Your messaging should also be simple and easy to digest, ensuring that it sticks in your customer’s memory.
Phishing attempts may be more sophisticated than ever before, but the fundamentals of not falling victim to an attack remain more or less the same as they always have.
