Blogger World: vishing

Wednesday, 19 November 2014

What is Phishing and How to Avoid it?

Wednesday, 19 November 2014 - 0 Comments

Phishing is one of the oldest tricks in the book of hackers. But as old as it might be, phishing still remains the most lucrative tool for cyber criminals; as they say, old is gold. This post tells you about phishing and measures you can take to avoid it.

What is Phishing?

Phishing is a fraudulent activity that is designed to trick the victim into revealing their personal and confidential information. This information usually includes bank account details, credit card numbers, and social security numbers to name a few. There are different ways a hacker can launch a phishing attack on his targets.

Phishing by Email

This is the most common phishing technique deployed by cyber criminals. Fake emails posing as crucial communication from a bank, ecommerce site or known legitimate entities are sent to the victim. These emails contain links to a fake Web site, which usually appears like a legitimate site and prompts the victim to sign in or divulge their personal information. In some instances, the phishing email itself contains an attachment of a form to be filled out by the victim. To trick the victim into visiting the fake Web site or fill out the form, such emails show a sense of urgency or a threatening situation. For instance, the target is informed that their bank account is at a risk of identity theft. To fix the issue, the user must verify their account by providing their banking details. The email might also claim that unverified accounts will be discontinued.

Here is an example of a phishing email that looks like it has come from Lloyds Bank:

[Source: http://www.banksafeonline.org.uk]

Phishing by Call

Phishing is no more dependent on emails. Fraudsters have started using the telephone as their new pawn. In a phishing call scam, the victim will receive a phone call from a person posing as an employee of a bank, a software firm, or any other known organization. If it is from a bank, then the issue will be usually related to the security of the victim’s bank account. The caller instructs the victim to call another number, which in most cases, will be an automated attendant. The attendant will ask the caller for their bank account details like account number, pin number, password, etc. In some instances, a phishing email may instruct the victim to call a number, instead of urging them to visit a website or open an attachment. Phishing by phone is also called vishing.

This is how a phishing call might go:

“Is this Mr. Brown? This is a call for you from (a popular) Bank. We have received reports of illegal withdrawals from your bank account. In order to contain the situation, and safeguard your account, we need to confirm your account number, expiration date, four digits at the back…” and so on.

SMiShing

Cyber criminals leave no stone unturned when it comes to having their way. Recently, there has been a sharp surge of phishing attacks that involve Short Message Service (SMS). Targets will be sent SMSs where they will be asked to click a link to a spoofed website. The website might ask the target for their personal information, or infect their computer with a malware. In some SMSs, the target is asked to call a certain number (sometimes toll free) and verify their personal information. Even here, phishers use scare tactics to trick the target. For instance, you might receive an SMS reading that your ATM card has been suspended or deactivated. To reactivate the service, you must call xxxxxxxxxxxx immediately.

Example:

Credit Union N.A. Please call us immediately at 1-888-xxx-xxxx regarding a recent restriction placed on your account. Thank you. [Source: www.t-mobile.com]

How to Avoid Phishing Attacks

Here are some simple measures you can take to prevent phishing attacks.

- Never entertain unsolicited emails, calls or SMSs.

- Your bank will never ask you for confidential information via emails, calls or texts. If you do receive any such communication, do not respond; even better, report the incident to your bank.

- Avoid accessing websites via links in email messages; especially those asking for personal information. It is always a safe bet to type the URL manually into the web browser.

- Do not fill any kind of form that comes along with an email.

- Provide your personal information only on secure websites. A secure website’s URL should always begin with “https” instead of “http”. Also important is the presence of a lock symbol on the website (see figure A). Clicking the lock icon should display the digital certificate that verifies the authenticity of the website.

Fig A.

- Look for spelling mistakes, grammatical errors or bad language in any email you receive; especially the ones you were not expecting. Emails from a genuine organization are proofread and edited before they are sent out to the customers.

- If you receive an email containing link(s), do not click it. Hover your mouse over the link and take a look at the left hand corner of the browser. It will display a link. Check if this link matches the one in the email. If it doesn’t, then suspect it as a phishing attack.

- If you receive any email from your bank that conveys a sense of urgency or threat, then call up your bank and verify the situation.

- Keep your system’s operating system updated and patched

- Go for an antivirus program that is capable of blocking phishing emails and websites.

- Keep a regular check on your bank account. Even if there is anything amiss, you will have enough time to contain the situation.

- Keep your web browsers updated and patched.

There is no silver bullet for phishing attacks or cybercrime for that matter. But taking the right precautionary measures, seeking help from the right authorities, and using the right security solution, do place us at a safer spot.