Phishing – a deceptive Internet practice to acquire sensitive details as usernames, passwords and credit card details by pretending to trustworthy entity via electronic communication such as E-mail.
Phishing is not new, it’s been around for ages BUT unfortunately there are many who know not how to detect phishing.
Today, I’ll be providing a few pointers on how you could easily identify PHISHING. While my examples will be using E-mail phishing, the logic applies to other form of PHISHING as well, even those like from SMS.
Here’s an E-mail that I received recently……….
What Did You Register With Them With?
Yes, KNOW what did you register with.
For example, I got this PHISHING E-mail in one of my E-mails accounts. The E-mail claims to be from our local bank’s online service website – Maybank2u.com
The first give-away in that PHISHING mail, was recipient address. I was dead sure I did not register that particular E-mail address for the bank’s online service. 🙂 So clearly these guys were spamming based on their E-mail database and hoping I’m one of the victim.
*I personally put the bulk of the blame on the idiots who put my E-mail under TO and CC instead of BCC for mass E-mailing purpose.*
So remember, if you’re receiving such notices on your E-mail or anywhere else that you didn’t register with a particular entity – then clearly something’s amiss.
Take Note Of The Link
In E-mail based PHISHING, it always comes with a LINK. That link will lead you to a website that will in most cases, look exactly like the actual website of the entity they claim to be.
So imagine if you entered your username and password – then it’s information in their hands already. 🙁 Another way to avoid such terrible plight is to take note of the URL (address) of the link provided. Just mouse over the link on your E-mail (whether it’s web-based or not) and it usually will show you where the link is going to bring you.
Here’s what it looked like on my Thunderbird E-mail application.
If you can’t find any indicator of where the link goes to, just click it. Don’t worry because PHISING sites usually don’t contain those nasty scripts as those malicious scripts usually trigger a response from anti-virus or browsers and it certainly would arouse your suspicion.
Now once you click on the link, you’ll be brought to the site. Look at the URL, especially the front portion right after the HTTP:// or HTTPS://. As long as it doesn’t look like the usual URL that you visit for your online transactions – AVOID it.
A tech-savvy person like myself would identify it without a problem but a less savvy person on the other hand could have a chance of mis-identifying, thinking that it’s a legitimate site. For example, maybank2u.com could be written as mayban2ku.com and get away with it. Some go to the extent to put subdomains that confuse or adds assurance to users, such as maybank2u.securenetdata0001.com (this URL is entirely fictional!).
Know The Source
Some PHISHING E-mails aren’t that cleverly done, their sender E-mail address gives away their identity immediately. On the other hand, there are others who are more detailed and send from what looked like a legitimate sender.
It’s not something hard to do, anyone could just configure it in their E-mail application
Badly Done Content
If you refer to the same image above, notice how titled the E-mail. And take note also on how they address you as Dear XYZ Customer.
I’m not saying that they can’t but usually it’s a good sign of being phishing E-mails. Even if they don’t address you personally, it almost always comes appropriately titled.
Some Things They’ll Never Ask
Entities like banks will never ask you for sensitive information such as passwords. Some might as for username but they certainly won’t ask for both username and password. Others would just ask you verification questions based on the data available on their end.
If you do come by E-mails, calls or SMS that asking you too many details, especially sufficient details to log in to your account or at least request for changes to your account – it’s clearly a PHISHING in action.
The Logic Factor
In the E-mail above, you’ll notice how odd it is that they publicly announced that they were hit by DDoS attack (I’m not going to explain what is DDoS attack), E-mail was sent but nothing of such notice was stated on the website.
Furthermore DDoS attack is not HACKING, which doesn’t interfere with data. And to make it all the more funny, who on earth would give you 24 hour notice before suspension? It doesn’t even make sense, because 24 hours and not accounting the time difference between mail sent and mail read does make it ridiculously MISSION : IMPOSSIBLE.
With a little bit of knowledge to help you with some logical thinking, you could sniff out additional pointers that discredits the E-mail further.
Repeated E-mails, Changing Content
Yes, sometimes they repeat.
So it’s a dead give-away. First they say it’s 24 hours to take action, then they send another mail like 48 hours later. And with a different link too! A really clear give-away.
Contact The Entity Involved
The safest best for anyone who isn’t savvy enough to do all the above – MAKE A PHONE CALL. Yes, call the entity and ask about the received E-mail. Just make sure that the number you called is the OFFICIAL number.
Share Your Experience
Did you think I miss out something? Please share, I’m sure it’ll be beneficial to everyone who read this article.