How to Catch Phishing Emails Before They Catch You

The term “phishing” was first mentioned back in 1994 when hackers breached AOL and tricked users into revealing their account passwords. Phishing attacks use malicious emails and fake websites to lure people into handing over their personal information. They’re called “phishing” because the hackers "fish" information out of unsuspecting victims. 

Knowing what to look for can safeguard your personal or financial information from bad actors. Plus, antivirus software with real-time phishing protection can stop phishing attacks before you become a victim. 

Phishing email warning signs

If you get an email that seems suspicious, the best defense is to delete it. Many phishing messages have mismatched email domains, claiming to be from reputable companies. If you get a suspicious link, you can see its address by hovering over the link with your mouse. Don’t click on the link. Here are the top email phishing red flags to look for:

• Bad grammar or misspelled words
• Generic greetings
• Mismatched email domains
• Unfamiliar or suspicious links
• Unrecognized senders
• Urgent messages calling you to act immediately
• Companies using the default @gmail.com 

Here are two examples of real phishing emails:

You may spot a phishing scam by looking for bad grammar or misspellings in the message. Some emails have generic greetings, which wouldn’t normally come from friends or professional companies (let alone a CEO). 

The above example is one you may receive frequently. You get a receipt or confirmation about a product you know you haven’t ordered, in this case, what appears to be a McAfee product. It contains a link that entices you to click on it, which may take you to a site to enter your credit card information to remain protected or to opt-out.

How does phishing work?

Phishing is so effective because attackers send compelling emails that look legitimate at first glance. Phishing emails usually direct you to a webpage that either delivers malware or allows you to enter your personal or financial information. You also may receive an attachment or link redirecting you to a phishing website.

Scammers aim to steal as much of your personal data as possible. Once they have it, they can access your social media accounts, financial information, and other sensitive data.

This is known as social engineering. The scammer manipulates you into doing something dangerous online, like revealing private information. Phishing is a form of social engineering where the perpetrators are looking for personally identifiable information and financial information like:

• Passwords
• Phone numbers
• Social security numbers
• Login credentials
• Credit card numbers
• Bank account numbers

If a phishing attack is successful, it can compromise your financial and social media accounts. That can mean unauthorized purchases and even identity theft. You can also get hit with ransomware that holds your information hostage until you pay to get it back. If you use identity theft protection, you should be notified if someone uses your information.

Phishing attacks can also harm companies. They can cause data loss and distribute malware throughout the organization, leading to devastating financial loss, reputation issues, and consumer mistrust.

Types of phishing attacks

Phishing attacks threaten everyone, so you need to know how to recognize them when they come your way. Numerous types of threats use phishing to steal your information. We cover these so you can spot them, hopefully before they can do any damage.

Email phishing

Email phishing is used by criminals who send a fraudulent message hoping you’ll respond by clicking a link or opening an attachment. Once you do, you’ll be directed to a site asking you to enter personal information. This comes as a savvy email that looks like something genuine you might need to open.

Spear phishing

Spear phishing campaigns use previously collected data in the email attack. That may be information regarding you or your employer. You may receive an email that creates a sense of urgency by asking you to act immediately. If you get a spear phishing email at work, it is usually an attempt to obtain your login credentials. It may have some information about you in the email that looks like it comes from someone you can trust.

Malware phishing

Malware phishing attempts to install malicious software on your device or company network. It comes as email attachments that might look valid. Sometimes, malware phishing can be disguised as seemingly harmless eBooks, PDFs, GIFs, or funny videos to tempt you to open them.

Pharming

Pharming is a bit different from regular phishing. It uses malicious code executed on your device to redirect you to the criminal’s website. You won’t get a link to click or an attachment to open. Pharming relies solely on code being run on your computer to target you. It’s a good idea to check your privacy settings on your device to limit who has access to your data.

Whaling

Whaling (AKA executive phishing) is a technique used by hackers. In this technique, hackers pretend to be senior members of an organization and target other people in administrative positions. The aim is to steal money or data for criminal gain.

Whaling uses email and website spoofing to get the target to reveal data or even transfer money. Spoofing works by creating a website that looks legitimate, so you’ll click on it and reveal private information to the scammers. Whaling targets specific individuals who would have access to sensitive information.

Smishing

Smishing is a combination of phishing and short message service (SMS). People use text messaging more frequently than emails, so many hackers use this method to get your information. They may text you with an infected link so you can click and download malware. The criminal will get your information and commit fraud to make money. Smishing scams are so popular with criminals that they’ve drastically increased in recent years.

Vishing

Vishing is a combination of phishing and voice recordings. The caller will leave you an urgent voicemail that tells you to respond immediately and call a certain number back. An example would be a message that your bank account has been hacked or suspended.

Another example is the extended car warranty phone call that most of us have received repeatedly. The end goal is the same as email phishing: the bad actor wants to steal your information for financial gain.

How to prevent phishing attacks

You can prevent phishing attacks by staying vigilant. Cybercriminals will always be looking to make a fast buck, but you don’t have to succumb to their savvy phishing games. Some ways to stop phishing attacks include:

• Education: Knowing how scammers use phishing attacks can help keep you from becoming a victim. Cybersecurity training will keep you updated on the latest phishing trends.
• Reporting: If you receive a suspicious message, report it to your email client, such as Microsoft Outlook. You can also report phishing emails to the FTC and to local law enforcement.
• Using spam filters: Spam filters can be your first line of defense to block a phony email before it gets to you.
• Using a password manager: A password manager can generate strong passwords for websites to help keep your data more secure. Third-party password managers offer strong encryption protocols and can help you store and manage your passwords securely.
• Installing antivirus software: Antivirus software helps guard against malware, including phishing attacks. The best antivirus coverage includes real-time malware protection, safe browsing features, ad blockers, and more. 

Top antivirus software with phishing protection

FAQs

Bottom line

Cybercriminals are getting smarter at deceiving us and taking advantage of vulnerabilities. Fortunately, you can use the above anti-phishing tips to thwart fraudulent activity. Always look for red flags, like spelling and grammar mistakes, suspicious links, and urgent demands or requests.

If you receive suspicious emails, report them to your email client or the FTC. For 24/7 online security, install antivirus software with real-time protection across your devices.