What to do so you don’t fall prey to phishing or spearphishing attacks

To avoid falling prey to phishing or spearphishing attacks, we need to check a website’s address before entering a password, turn on two-step verification and confirm any unusual request through another channel, especially when it involves money or login details.

In this article, we’ll look at some of the types of phishing and discuss how to behave so we don’t fall prey to these attacks.

Phishing is a social engineering technique hackers use to try to obtain users’ passwords and sensitive data. Their goal is to compromise accounts so they can get at even more personal information or at the victim’s money.

Phishing attacks happen by email (see also how email works), by phone, by text message or through messaging apps, and the user is usually asked to enter their login details on a fake website. The malicious pages look just like Microsoft 365, Dropbox, Facebook, or the website of a bank, a courier company or a public institution.

Phishing on Facebook

It’s fairly common for the emails you receive to imitate Facebook or Dropbox notifications. More precisely, to tell you that someone mentioned you on Facebook or that someone shared a document with you on Dropbox. The most common version in companies today imitates Microsoft 365: a “shared document,” a “full mailbox” or an “expiring password.”

These attacks rely on users not paying attention, clicking the links they receive by email and then logging in to the fake platform. Most of the time, after the login details are entered on the fake site, the user is redirected to the legitimate service, so they don’t notice anything.

If the email address is compromised, hackers can also gain access to other accounts created with that address.

There are also cases where hackers study the incoming correspondence and plan targeted attacks.

Spoofing

Spoofing is a technique hackers use to fake the sender’s address, so the messages they send appear to come from legitimate addresses (e.g., no-reply@facebook.com).

The same goes for phone calls. Your phone may display the bank’s number, but there’s no guarantee that the people calling are actually from the bank. If in doubt, hang up and call the bank’s official number yourself.

Email spoofing can largely be blocked with three technical settings on the domain: SPF, DKIM and DMARC. Since February 2024, Google and Yahoo have required them from senders who send large volumes of email. For a company, configuring DMARC prevents anyone from sending emails that appear to come from its domain.

Fake URLs and phishing sites

Hackers buy domains with names very close to those of legitimate services (e.g., goolge.com instead of google.com) or use various subdomains (e.g., facebook.com.importantsecurityreview.co).

More and more often, the link doesn’t appear in the text at all, but in a QR code: on a poster, on an invoice or in an email. A QR code scanned with your phone can just as easily take you to a fake site, and on a small screen the address is harder to check.

The difference between phishing and spearphishing

Spearphishing is a phishing attack customized to target a single person. These attacks can be very effective, because they use real information to trap the user.

Phishing attacks are sent in bulk to many users.

To launch phishing or spearphishing attacks, hackers use spoofing to make the messages look legitimate.

In companies, the most costly form of spearphishing is business email compromise (BEC): a message that appears to come from the director, the accountant or a supplier asks for an urgent payment or announces that the supplier has changed its bank account.

What has changed in phishing since 2021?

Phishing has become harder to recognize in recent years:

• Messages are written with artificial intelligence, so they no longer have the clumsy wording that used to give them away, not even in Romanian.
• Voices can be imitated. Attackers can clone the voice of a boss or a relative from a few public recordings and call with an urgent request.
• The two-step verification code can be intercepted. Some phishing kits sit between the user and the real site and steal the session opened right after login, including the code received by text message or from the app.
• QR codes have become a common way to hide the link, as we showed above.

How do you recognize a phishing message?

A phishing message almost always shows at least one of these signs:

• it rushes you (“your account will be blocked in 24 hours,” “the payment must be made today”);
• it asks you to log in, download a file or confirm personal or banking details;
• the address of the sender or of the link doesn’t exactly match that of the company it imitates;
• it arrives unexpectedly, from a courier company, a bank or an institution, about a parcel, a payment or a debt you didn’t know about;
• it asks you to change a supplier’s bank account or to make a payment outside the usual procedure.

How can we secure our accounts so we don’t fall prey to phishing attacks?

To avoid becoming a hacker’s victim, it’s best to turn on two-step verification for every service that offers this security feature.

Even if a hacker manages to trick you and learn your password, in most cases they won’t be able to log in to your account, because they can’t pass the next security step. Since some phishing kits can intercept the code too, the safest options are passkeys and physical security keys: they only work on the real site, so they can’t be used on a fake page. You’ll find more in the article with basic rules for creating secure passwords.

Even so, users should be very careful about the links they click and always check whether the browser’s address bar shows the name of the legitimate site or something that merely looks very much like it. The safest way is to go to the site by typing the address yourself or from a saved bookmark, not through the link you received.

What do you do if you clicked a phishing link?

If you entered your password on a fake site, change it immediately from another device and log out of all active sessions on the account. Then:

• tell your IT team, who can check whether anyone else has logged in and block their access;
• if you entered your card details, call your bank immediately, using the number on the back of the card;
• change the password on any other accounts where you used it;
• report the message as phishing from your email app; cybersecurity incidents can also be reported to DNSC (Romania’s National Cyber Security Directorate) on the single number 1911.

How does a company protect its employees from phishing?

A company protects itself from phishing by combining technical measures with staff training:

• email filtering, which stops most messages before they reach the inbox;
• SPF, DKIM and DMARC configured on the company’s domain;
• mandatory two-step verification for all employees;
• a written rule for payments: any request for an urgent payment or a bank account change is confirmed by calling a number you already know, not the one in the message;
• regular training, with real examples and phishing simulations.

See also the article on 5 simple cybersecurity actions for small and medium-sized businesses.

RezolvIT is an ISO/IEC 27001-certified managed IT services company in Bucharest that places great value on following security standards and on securing office infrastructure. We handle IT security for companies of all sizes, starting with a free IT audit.