September 10, 2013
—
CSO
—
As explained in a previous story, the editorial team at CSO was targeted by a phishing campaign recently. If it had been successful, the person(s) behind it would have tricked us into installing the Zeus Trojan, a nasty bit of financial malware.
Lucky for us however, our user awareness training took hold, and we used some basic logic in order to spot the scam. So in addition to a visual breakdown, which you can see here, this article will address some basics when it comes to spotting and dealing with a phishing attack.
[Related slideshow: How to spot a phishing email]
Each time an email arrives, for most us anyway, it is quickly scanned. Based on a few key elements within the message, the choice of what to do with it is made.
Check the address fields, subject, and look at the attachment(s)
The first area of focus that will determine what is done with the email is the address section. If the email is from someone you know, or from someone of importance (such as your boss), you’re likely to act on it. At the same time, this is also where the first question about the email should be asked; namely, do I know this person? If you don’t, this is the first red flag.
Subject lines set the tone for an email, and are the attention getters. This is where you learn, in most cases, what the email itself is going to focus on. Criminals know that they need to grab your attention, so they will use subject lines that invoke fear, invoke curiosity, or instill a sense of emotion or authority. When it comes to spotting email scams, remember the saying “never judge a book by its cover,” and ignore intent of the email’s subject — no matter what it says.
The address fields and subject area are often all someone needs to determine if they will act on a given message. However, even if these areas look good, there may be a problem.
Does the email have attachments? If the email has attachments, you’re likely going to want to open them and address them at some point, but the best advice is to stop and question them first. Were you expecting attachments from the person who allegedly sent the email? If you don’t know the person, then why are they attaching files? Even if you do know the person, why did they send the files if they were not expected? If you’re not expecting file attachments, then you should avoid opening them.