Utility Telecom is a California-based company offering cloud-based, productivity-enhancing telecom services. The company is also highly committed to data protection, offering Versa’s SD-WAN as well as ongoing education and awareness about a variety of critical cybersecurity issues.
One such issue is phishing, which remains a major security threat to organizations of all sizes.
Here is an overview of phishing, provided by Utility Telecom:
What is Phishing?
Phishing, the company explains, is a method of collecting data using emails, websites, and links that are designed to mimic trusted sources. In doing so, fraudsters can trick users into disclosing private information such as passwords and credit card numbers.
In the past, fraudsters have duped internet users into visiting knock-off or misspelled domains, but their latest scams are much more sophisticated and harder to spot. By performing a homograph attack, a trick that allows users to register domains with characters and various alphabets instead of the default Latin script, phishers can create domain names that appear identical to legitimate web addresses.
Signs of a Phishing Site:
- The Web address – A misspelled or incorrect company name, or extra characters are all signs of illegitimate sites.
- Pop-ups – If you’re sent to a website that immediately displays a pop-up asking for your login credentials, you’re probably on a phishing site. Some phishing scams will even direct users to legitimate sites before displaying pop-up ads to gain a username and password.
Signs of a Phishing Email
Immediate action required – Scammers tend to use language that will get a user’s immediate attention. Watch for emails that include urgent calls to action and state that an account has been compromised or will be soon be closed. Scammers also tend to use language about maintenance activities, upgrades, and “routine security checks.” These phrases are all intended to trick users into providing confidential information like login credentials or personal data.
The email domain – These messages often do not come from obviously corporate email addresses like CustomerCare@chase.com but instead from addresses like julia64@hotmail.com, so pay attention to the little details.
Links to fake websites – Fraudsters may include links to fake websites that look identical to legitimate websites, using tactics like fake logos. Watch for web addresses that contain the official company name, but in the wrong location, or authentic links mixed in with fake links to make the phishing site appear legitimate.
When in doubt, remember to navigate to websites directly rather than using links, and if you do receive an unsolicited email, delete the message and reach out to the business to verify whether it was legitimate. Some phishers are brazen enough to provide the real company’s customer service email and phone number in the message in an effort to convince you of their identity. The phishers don’t have a call center, so they just gamble that you won’t make the call to verify.
How to Prevent Phishing Attacks
Look for the padlock icon in your browser indicating TLS or SSL encryption and check for a valid website security certificate (a digital file that verifies a site’s identity) before entering any of your personal information. Avoid accessing websites through links sent in emails or from around the web. Instead, type the address yourself in the URL bar, or use trusted direct links.
Pay careful attention to the true destination of the links they send, as the browser will verify where you’re going. This is an obvious giveaway and one that cannot be hidden. The browser tells you definitively where you’re visiting and is one of few things you can trust.
Misspellings and “close” names are also sometimes used fraudulently. With all the new TLDs out there, you can obtain “Chase.travel” as an example and your email system may not display the true destination but your browser will. Try hovering over the link in your email and notice when it doesn’t match the rest of the email.
Many times URLs are short and have two-letter domains at the end because they are registered overseas, such as “goguscerrahisi.com.tr.” This is a domain registered in Trinidad in the Caribbean and obviously not Chase.com, or anything similar.
These schemes cannot prevent your web browser from revealing your real web destination, so with a little care and diligence, you can prevent yourself from being duped.
