How a Phishing Scam Works and What You Can Do to Protect Yourself

Most hacking attacks are the result of a flaw or vulnerability found within the code of a program or operating system, but we rarely take into account the ones that don’t. Hackers often take advantage of the human side of hacking as well, a process known as “social engineering.” This is usually the act of conning users into handing over personal information of their own free will, and it’s surprisingly effective.

As you can imagine, social engineering involves exploiting the people who work with the technology rather than the technology itself. This particular method allows those who might not be as tech-savvy (or those who aren’t particularly known for their common sense) to obtain important information, like passwords or dates of birth, from unsuspecting foes. Those who are more skilled with technology can perform more elaborate social engineering attacks, like replicating websites to infect systems with malware upon visitation, or download infected software.

The most well-known social engineering hacking attack comes in the form of a phishing attack. These are typically the type of emails which appear to be the genuine article from an institution you might have relations with, such as a bank. These emails request that you update or confirm your personal information. It can be difficult to discern these from the real deal at times.

Other, more focused attacks are called spear phishing attacks. These are designed to target a specific individual, or multiple specific targets. Sending emails personalized to get users to fork over financial information, or even going to lengths such as contacting your business posing as someone from a media outlet.

According to HowToGeek.com, this method isn’t limited to being used remotely. Social engineering hackers can also get up close and personal with their attempts:

An attacker could walk into a business, inform the secretary that they’re a repair person, new employee, or fire inspector in an authoritative and convincing tone, and then roam the halls and potentially steal confidential data or plant bugs to perform corporate espionage. This trick depends on the attacker presenting themselves as someone they’re not. If a secretary, doorman, or whoever else is in charge doesn’t ask too many questions or look too closely, the trick will be successful.

How To Prevent Social Engineering Attacks
In the end, keeping your business safe from social engineering attacks comes down to identifying them from the genuine article. In order to minimize the risk of falling prey to these hacks, keep these tips in mind.

• Some suspicion is better than none at all. If you’re receiving strange emails, messages, or phone calls from users you don’t recognize, it’s best to be on the safe side and not respond until you’re sure that you’re dealing with the real deal. It’s better to call the institution at the number you have on record before handing over any information you feel is suspicious. If something seems suspicious, such as poorly worded emails and strange links, it's best to question it.
• Avoid links in emails to websites which gather sensitive information. These websites could be fake phishing sites designed to look like the official institution website. For example, you receive an email asking to update your bank information, and the link leads to a sign-in form. This is a fake site designed to fool you into entering your credentials. In this case, it’s best to try logging into the official site rather than through the email. Look at the URL and scan it for subtle differences which might hint at trickery.
• Enable spam and phishing filters for your email and browser. Some browsers have built-in phishing and security filters, which should always be active. These can prevent your employees from accessing a known phishing site. One particularly powerful solution is Directive’s Unified Threat Manager (UTM). This solution equips your business with everything it needs to keep outside threats from getting into your network, including spam filtering and web content blocking.

Ultimately, the best defense against social engineering hacking attempts is to stay vigilant and educated about how to best approach suspicious situations on the web. Directive can equip your business with the tools it needs to stay safe and educate your staff on how to identify fraud when they see it. For more information about how Directive can keep your business safe, give us a call at 607.433.2200.