How can you recognize and prevent phishing?

Recognizing phishing

You can perform a number of checks to identify a phishing attempt:

1. Does the e-mail contain spelling mistakes, poor grammar, or other obvious errors? Bear in mind, however, that fraudsters are getting better all the time, so even perfectly written e-mails can pose a risk.
2. Does the domain name of the sender’s e-mail address differ from the real domain name of the company that is supposedly sending the e-mail? You can check this in the source code of the mail. And by hovering over a link you can check whether the URL of the link in the mail is different from the real domain name of the company. Remember that fraudsters make the domain names as plausible as possible and there might be only a single different character.
3. Fraudsters try to creare a sense of urgency. If you are asked to do something urgently or quickly (often just before the weekend or a public holiday), be on your guard.
4. Is the mail addressed to you personally? Phishing e-mails are often not addressed to you personally because the fraudsters don’t know your name.

Necessary suspicion

A healthy dose of suspicion when it comes to e-mail is wise. Does the message seem appropriate, given the compay company that sent it? Is it normal for the company to be making this request? You will generally know what to expect from long-time clients and suppliers. Koen Bossaert, Solution Lead Vulnerability Management and co-founder at Davinsi Labs, gives a few guidelines: “If it sounds too good to be true, then it probably is. And are you being asked to do or pay for something immediately to prevent your account or something else being blocked? That should ring alarm bells.”

If it sounds too good to be true, then it probably is. Is urgent action required? That should ring alarm bells.

Koen Bossaert, Solution Lead Vulnerability Management and co-founder at Davinsi Labs

Double-check via another channel

“It’s crucial to think twice; especially when money is involved,” says Wouter Vandenbussche, Solution Lead Cybersecurity at Proximus. “Codes or account details are never requested via mail or phone. Another red flag is if you get a request to install software. That’s why we recommend – if at all possible – to check via another channel whether the info in the mail is correct.”

Carrying out these kinds of checks on composition and content will help you to recognize phishing attempts. And even though it’s more difficult, they should also be done on messages received on mobile devices or via other channels such as text message and messaging services. Every phishing message that you or your staff recognize is one in the eye for the cybercriminals.

Awareness-raising campaigns are important. Be active in implementing these campaigns in your workplace.

Wouter Vandenbussche, Solution Lead Cybersecurity at Proximus

Preventing phishing

There are three ways to prevent phishing:

1. Making people aware is the first and most important line of defense where phishing is concerned. Cybersecurity awareness among staff members can be significantly increased by conducting regular simulated phishing campaigns.
2. Secure incoming traffic with traditional filters such as anti-spam and filter communication tools for incoming messages.
3. Secure outgoing traffic by, for example, scanning URLs or the content of outgoing messages.

Internal awareness-raising

An essential part of a good security strategy is preventive action through raising awareness. This prevents employees being caught out by phishing mails that arrive in their mailbox. The best way to conduct an awareness-raising campaign is to clearly explain what phishing is, how staff can recognize such messages, and what the impact is. And this messaging should be repeated on a regular basis via various media such as posters, video clips, and newsletters.

A simulation of a phishing attack also makes the dangers visible, especially when the results are used in a campaign to increase vigilance. The more personal and relevant to the staff members, the more attention the campaign will attract and the better the results will be.

Simulated phishing attack

Koen Bossaert: “An astonishing number of people are fooled during these simulated attacks. In one test, we sent a phishing mail during the Christmas period that allegedly came from the company, announcing that the Christmas party had been postponed. More than 80% of the staff handed over their details. Even people from management and IT.”

Clicked. Details sent. What now?

When you click on a link in a phishing mail, the damage needs to be minimized as quickly as possible by:

1. Blocking or resetting accounts and changing your passwords.
2. Immediately checking logfiles to see whether there has been an attack, and whether any other phishing messages have come in. This information is useful for monitoring data on new attacks. There may be a larger-scale phishing campaign being directed at your company. There have been cases where the HR department has been contacted, supposedly by members of staff, and asked to change bank account numbers for salary payments.
3. Tighten up prevention measures with the results of a survey, for example by blocking the domain names associated with the attack.

How to inform customers?

It is always a good idea to inform clients about any communication that they should expect. For example, if your company never asks for personal or account details via mail or always sends e-mails from the same address, you can mention this to new clients or communicate it on your website.

That way, new clients will be aware of the situation. An incident hotline, where clients can warn of a phishing attack being conducted in the name of your company, combined with an investigation of any reports that come in and adequate communication, can ensure that the impact of a phishing attack is limited.