Businesses need to be vigilant against an increase in targeted, sophisticated email fraud. We have seen a spike in ‘socially engineered fraud’, where scammers use advanced methods to extract money from their victims.
Of the million messages sent to our Internet Service Provider (ISP) business clients, we are now monitoring more than 200 emails a day in which fraudsters appear to adopt someone’s email address and try to encourage financial transactions with that account holder’s contacts.
Fraudsters are relentless in using email to obtain money illegally.
Common email fraud, known as phishing, aims to trick recipients into believing they know the person or company writing to them. To avoid these scams, recipients can check the address the message comes from, which will show it has no connection to the supposed sender. We’ve included more tips below.
However, this latest method can not only trick recipients with a genuine-looking message, but can also fool monitoring systems and programs, including Microsoft Outlook, into treating it as sent from the real email address.
Fraudsters also research the accounts they are mirroring and those accounts’ contacts, to make the emails more convincing and dupe unsuspecting victims.
This could have serious financial consequences for North East businesses, and as a responsible Internet Service Provider we are continually creating new variables to stop this practice affecting our clients.
Having identified this new practice, we are employing new protocols in our automated email monitoring systems, including the ability to identify the fraudster’s Internet Protocol (IP) address, to capture these emails before they reach their recipients.
Every day at Odyssey we see 1000s of phishing emails through our MailShield platform. Some are so outlandish or poorly constructed that they are obviously fraudulent, but others are far more convincing.
So how can you tell a legitimate email from a phishing email? No single trick always works, but there are things you can look out for to help keep yourself safe. Here are five tips.
1. The message contains a non-matching URL
One easy check in a suspicious email is the embedded URLs or clickable links. A link may say PayPal.com, but if you hover your mouse over it you will see the real address it will visit (do not click the link).
Good practice is not to click the link in the email, but to open your browser and log in from there. So if you receive an email from PayPal with a link to an invoice, type www.paypal.co.uk into your web browser and log in to check whether the invoice is real. This way you can be sure you are entering your details into PayPal.
Always do this for ‘Your Money or Your Life’ transactions online: anything that involves financial transactions or entering information that could be used to steal your identity. Legitimate, reputable companies will never request this kind of information by email.
2. Misleading domain names
Phishing scams often depend on the victim not understanding how domains and DNS work.
For example, login.paypal.co.uk is a child of paypal.co.uk, because paypal.co.uk is the final part of the domain. In “login.paypal.co.uk.ca2.com”, however, “ca2.com” is the actual domain, not paypal.co.uk, which is now a child of ca2.com.
Along with misspelled domains, this is one of the tricks we see used most to fool users into handing over login details or personal information.
3. Email has poor spelling and grammar
When a large organisation sends an email, you can be sure it has been checked for legality, spelling and grammar.
If a poor-quality email claims to be from a large firm, it is almost certainly a phishing email.
If you are really unsure, the safe thing to do is call the company that has supposedly emailed you. If you do not know the phone number, get it from their website. Do not trust the number in the email. A reputable firm will be easy to contact and can verify any requests made.
4. Requests for personal information
Even if an email looks official and is professionally presented, it should never ask for personal information, passwords, credit card details or answers to security questions.
Again, if you are still unsure, open your web browser and log in to the company’s official website, or call them using the number from their website, not the email. Do not use the link in the email.
5. Keep your computer secure
Some phishing emails and other spam contain software that can record your internet activity (spyware) or open a ‘backdoor’ that gives hackers access to your computer (Trojans). Installing good-quality anti-virus software and keeping it up to date will help detect and disable malicious software.