Protect Yourself from Phishing Scams

Phishing scams remain the top-reported online crime, with AI-powered phishing scams exploding. Global volumes are up about 140%.

In this blog, we'll take a closer look at how phishing works and how you can protect yourself from being fooled by scammers.

What is a phishing scam?

Phishing is a type of scam that tries to get you to give up personal information and/or to authorize payments. Phishing scams are designed to look like official communications (IE: emails or texts from banks, online retailers, and/or delivery services); they may incorporate fake QR codes, AI-powered fake videos/ impersonations, fake invoices, phone messages using cloned voices, fake websites, and fake search engine ads.

What does a phishing scam look like?

Phishing emails are designed to look like they are coming from a legitimate company or person, but they're not! These communications often have the following characteristics:

• They contain a link to a website that looks like it's real.
• There is an urgent request or sense of urgency in the subject line. This can be anything from "You're in danger" to "This account will be shut down."
• The email has an attachment, which may contain malicious code or files that allow hackers access to your computer when you open them.
• It may have a phone number that connects you directly to a scammer, ready with a convincing story designed to pressure you into making an immediate payment.
• Too good to be true online deals from reputable brands/companies.

How to protect yourself from a phishing scam.

• Use phishing-resistant multi-factor authentication, and avoid SMS-only 2FA.

SMS-only 2FA (two-factor authentication) refers to the second layer of security for logging into an account that is provided exclusively through a text message (SMS) sent to your phone. After entering your username and password, you receive a one-time code via SMS, which you must enter to complete the login.

While this is better than having no 2FA, it’s considered less secure because:

• Hackers can trick your mobile carrier into transferring your number to their SIM card.
• Text messages can be intercepted or redirected.
• Malware on phones can read SMS codes.

More secure alternatives include app-based codes (like Authenticator App) or hardware security keys (FIDO2, YubiKey), which are resistant to phishing and SIM-swapping. Ask you local computer guru to assist you in implementing these must-haves.

• If you get an email or invoice from a company you do business with or see an online ad that seems too good to be true --- check whether it's legitimate. Contact the company directly (don’t click a link from the suspicious communication) and ask if they sent you the email, text, and/or if the sale price is real.
• Don’t click on a search engine / online ad for the deals offered by that retailer. Instead, go to that company’s website and/or app to access those savings.
• As hinted above, if you receive a suspicious email or text, never click on the links or attachments inside them because they could lead to malicious sites that can infect your computer with viruses or spyware.
• Use anti-virus software on all of your devices (laptop, phone and tablet) as well as any other computers at home that access the same network as yours - this will help protect against malware attacks coming through other WiFi/Ethernet cable sources.
• Establish a code or question/answer between yourself and your loved ones, so you can identify if a caller urgency requesting help or funds is truly a relative or a fake (a cybercriminal).

Other common scams to watch out for:

• A cybercriminal may claim they need your credit card number to stop charges made in your name. This is a scam, since you should never give anyone your credit card number over the phone unless YOU initiated the call.
• You’re asked to pay for a prize that you didn’t sign up for.
• You’re told that you need to pay a fee to get a refund. (This is a popular during tax season.)
• Cybercriminals are placing fake QR Codes over legitimate ones now, redirecting victims to malicious sites.

To help identify if a QR Code is malicious, look for tampering or overlays (a sticker over the original). Consider the surroundings – if the code is on a random flyer, lamppost, has a call-to-action that says, ‘Scan now to claim cash’, or you receive it via an unsolicited email or post office mail … It’s suspicious. Don’t scan it.

• You’re told you have an unpaid toll or missed a delivery.
• Tech-support scammers pretend to be from well-known tech companies and trick victims into granting remote access. 
• Fake recruitment ads or job offers ask for social security numbers, bank information, and/or payments for training and equipment.
• Watch out for fake charities; they are popular after crises and natural disasters.

Conclusion

You need to be on the lookout for phishing scams because they now span more channels than just emails and texts. Cybercriminals are using AI-powered programs against us, making it extremely difficult to identify if a communication or video is real or fake.

Stay Vigilant!