Simple steps to deal with phishing

Know how to recognise valid emails.

• Is the email from someone you know or have received an email from before?
• Is it something you were expecting?
• Does it look strange (e.g. unusual spelling or other errors in the email address or domain name)?
• Has it passed the anti-virus test?

If you think there’s a possibility that an email is not genuine, forward it to your IT team or manager. Do not respond to it.

Signs that it may be a phishing email include:

• Emails signed with a generic signature block, such as “Customer Service” rather than an individual’s name, title and other details.
• The email address or domain name do not match the “from” name, for example the email purports to be from “John Smith” or “The Smith Company” but the email address bears no relationship, such as: phishingagogo@ theftonline.com,
• Emails purporting to be from a business or a government agency but sent from generic mail services such as Gmail or with an unrelated email address
• Emails from organisations with which you have had no prior relationship
• Emails conveying a sense of urgency – attackers often use the ‘urgency strategy’ to put pressure on the receiver to take action immediately
• Emails with offers that are “too good to be true”
• Emails asking for information e.g. passwords or logins.

Think before you click

Employees should not open suspicious links in emails, tweets, social media posts, online ads, messages or attachments, even if they think they know the source.

Before clicking any links, users should hover their mouse over the link to see if the link will lead to the correct destination - the website address underneath the link should show up. Some links may look genuine, but lead you to a different, possibly fake or scam, destination or result in the downloading of a virus or malware onto the computer and into the workplace network.

Beware of attachments

Banks will never send an email which has a link or an attachment to their Internet banking site. You should always manually type a bank’s website address into the address bar rather than following a link.

Verify the email

If you are unsure about whether an email is from a legitimate company or government department, try calling the organisation that appears to have sent the email. Get the contact details from a previous account statement or invoice or look it up online. Do not use any of the details or links provided in the suspicious email until you have verified that the email is genuine.

Whaling

Whaling is a kind of phishing where hackers target the “big phish” – specifically managers and senior executives. These high-profile targets typically have access to more information and consequently the payoff may be bigger. Whaling can be used to try and fast track executive sign-off on a payment.

• If, for example, an employee receives an email claiming to be from a manager asking for a payment to be made or to send personal information, they should not complete the request until it is confirmed as a genuine request.
• Never bypass standard payment approval processes within your organisation in response to an unexpected email or phone call.
• Employees should also be careful about how much information they provide over the phone to contacts they have not dealt with before. This information could be used to carry out phishing or whaling scams.

Help with cyber insurance

Cyber risk insurance helps you recover if you were to experience a cyber attack through internet or email. Contact us to find out more about a cyber insurance package to cover your risks.