When to Use?
This article discusses the do's and don'ts for navigating phishing and social engineering.
Social Engineering
Here are some common signs to help you recognize an attack.
Phishing - Using email to trick you into providing sensitive information, to include a Reply to the original malicious e-mail, clicking on bogus links or opening attachments, and entering data.
Spear Phishing - These are phishing attempts aimed at specific targets.
Pretexting - Typically utilized in email, this is a technique where a fake situation is created using publicly available details on the target where the information is used for manipulation or impersonation.
Scareware - As the name implies, a frightful pop-up attempting you to type in confidential, personal, and private information in order to rectify an infected computer issue.
Vishing - Utilizing the telephone in attempt to trick you into providing valuable, most likely confidential, information.
Smishing - Using text messages (SMS) to trick you into providing sensitive information.
Baiting - An attempt to hook you in by offering goods, such as a free device or gift card.
Do's and Don'ts
DO...
- Check the FROM and REPLY-TO addresses, be wary of perceived reputable companies with Gmail or foreign email addresses.
- Mouse over links to see the real destination.
- Keep your anti-virus software up to date.
- Use different passwords for your accounts, and immediately change if you suspect an issue. Consider using a passphrase, password manager such as LastPass, or implementing multi-factor authentication for added protection.
- Forward phishing emails to phishing@gvsu.edu.
DON'T...
- Click on any links or attachments unless you are sure it is from a trusted source.
- Give out personal or private information.
- Fall for emails because the branding looks real or appears to be from someone you know.
- Click or call listed phone numbers that are included in pop-up ads or messages.
- Forward a phishing email to other people, except to report it. Do not reply to phishing emails.
Additional Phishing Tips
- Look out for mismatched URLs – hover your mouse over the URL and compare the address.
- Poor grammar and spelling could be an indicator that it is a phish.
- A request for personal information, or worse, asking for money, especially with urgency, can be a phish.
- An offer that appears too good to be true probably is.
- Unrealistic or unlikely threats could be a phish.
- An unfamiliar greeting or salutation could indicate a phish.
- A demanding urgent action that tries to rush you into taking action before you have the opportunity to fully study the message for potential flaws or inconsistencies, can be a phish.
- Content just doesn’t look right - trust your instincts. If you need a second opinion forward the message to phishing@gvsu.edu.
Attempts often take advantage of current events and specific times of the year, such as:
- Natural disasters or significant weather issues
- Global health scares, even flu season
- Financial or monetary concerns, like IRS scams
- Major political elections
- Holidays and celebrating events, such as international athletic events
Also be on the look out for:
- Messages demanding your user name and password to keep your account active.
- Messages warning you of items pending on a mail server,
- Messages requesting your cell phone number.
- Messages asking you to purchase gift cards.
- Messages offering unsolicited job offers or work from home opportunities.
- Messages containing fake html voicemail attachments requiring you to log in (attachment has a .html file extension).