Dangerous Vishing Scams On The Rise As The Holidays Approach
Cybercriminals keep changing their tactics as the end of the year approaches—that’s how they turn targets into victims. Are you aware of vishing, one of the latest variants of phishing?
A relatively new variation of phishing has been making the rounds—cybercriminals are now embedding malware in emails and disguising it as a voicemail recording, or simply tricking users into calling a dangerous phone number.
In this article, we’ll answer the following questions to help you protect yourself against this and other forms of phishing:
- What Is Phishing?
- What Is “Vishing”?
- Why Is Phishing Dangerous?
- How Can I Tell If It’s a Phishing Email?
What Is Phishing?
Phishing is a method in which cybercriminals send fraudulent emails that appear to be from reputable sources in order to get recipients to reveal sensitive information and execute significant financial transfers.
Phishing attacks are mass emails that request confidential information or credentials under pretenses, link to malicious websites or include malware as an attachment.
With only a surprisingly small amount of information, cybercriminals can convincingly pose as business members and superiors in order to persuade employees to give them money, data or crucial information.
The reality is that cybercriminals can keep doing the same old thing because users keep falling for the exact same tactics without ever seeming to learn the cybersecurity measures needed to protect against them.
What Is “Vishing”?
This is one of the latest variants of phishing being tracked by cybersecurity professionals. Instead of attaching malware to an email and disguising it as, say, a PDF, cybercriminals specifically disguise it as an audio file, and make it so the email appears to be from an automated voicemail service.
Similarly, cybercriminals may simply send an email telling the recipient to call a phone number and address a serious issue. The number they call, in reality, connects them with a cybercriminal that will attempt to trick them into divulging personal information.
These legitimate services are more and more common in the business world today. When a user receives a voicemail, they also get an accompanying email with a recording of the message for them to review without having to access their voicemail inbox.
Regardless of how vishing works, it’s based on the same principle as all other types of phishing—it assumes the user will believe that the email is legitimate, and will download the attachment.
Why Is Phishing Dangerous?
The average phishing attack costs businesses $1.6 million. The problem with the rising tide of cybercrime incidents (e.g. the rate of phishing attacks increased by 65% in recent years) is that you get desensitized to the whole thing.
Cybercrime attacks continue to happen on a regular basis; new variations on the same old trick that pop up over and over again point to a bigger problem than the actual scams – businesses aren’t learning to protect themselves. That’s why the number of reported phishing attacks has gone up by 65% in the past few years.
How Can I Tell If It’s A Phishing Email?
Share these key tips with your employees to ensure they know how to spot a phishing attempt:
- Incorrect Domain: Before even taking a look at the body of the message, check out the domain in the sender’s address. Maybe they claim to be from your bank, or a big name company—but talk is cheap. It’s much more difficult to spoof an actual domain name, and so it’s more common to see domains that are closer, but not 100% correct. If it seems fishy, it probably is.
- Suspicious Links: Always be sure to hover your mouse over a link in an email before clicking it. That allows you to see where it actually leads. While it may look harmless, the actual URL may show otherwise, so always look, and rarely click.
- Spelling and Grammar: Modern cybersecurity awareness comes down to paying attention to the details. When reading a suspicious email, keep an eye out for any typos or glaring errors. Whereas legitimate messages from your bank or vendors would be properly edited, phishing emails are notorious for basic spelling and grammatical mistakes.
- Specificity: Another point to consider is how vague the email is. Whereas legitimate senders will likely have your information already (such as your first name) and will use it in the salutation, scammers will often employ vaguer terminology, such as “Valued Customer”—this allows them to use the same email for multiple targets in a mass attack.
- Urgent and Threatening: If the subject line makes it sound like an emergency: “Your account has been suspended”, or “You’re being hacked”. That’s another red flag. It’s in the scammer’s interest to make you panic and move quickly, which might lead to you overlooking other indicators that it’s a phishing email.
- Attachments: Phishers will often try to get you to open an attachment, so, if you see an attachment in combination with any of the above indicators, it’s only more proof that the email is likely part of a phishing attempt.
In the end, the key to phishing methodology is that it doesn’t rely on digital security vulnerabilities or cutting-edge hacking technology; phishing targets the user, who, without the right training, will always be a security risk, regardless of the IT measures set in place.
Making security education a routine for your entire team – management included – is the most effective way to stop a phishing attempt. Waiting for another major cyberattack to start making the rounds is not the time to start investing in your staff’s cybersecurity awareness.
Waiting for another major cyberattack to start making the rounds is not the time to start looking at providing cybersecurity training for your staff- at that point, it’ll be too late. Making cybersecurity education a routine for your entire team—management included—is the most effective way to ensure your team can spot and stop a phishing attempt.
Thanks to Holden Watne with GenerationIX, a Los Angeles IT consulting professional for his help with this article.