{"id":11129,"date":"2021-03-02T15:16:54","date_gmt":"2021-03-02T20:16:54","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=11129"},"modified":"2023-05-17T12:15:26","modified_gmt":"2023-05-17T16:15:26","slug":"10-types-of-phishing-attacks-and-phishing-scams","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/10-types-of-phishing-attacks-and-phishing-scams\/","title":{"rendered":"10 Types of Phishing Attacks and Phishing Scams"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-phishing-attacks-result-in-significant-losses-and-damages-to-businesses-every-year\">Phishing attacks result in significant losses and damages to businesses every year<\/h2>\n\n\n\n<div class=\"wp-block-advanced-gutenberg-blocks-notice is-variation-info has-icon\" data-type=\"info\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"10\"><\/circle><line x1=\"12\" y1=\"16\" x2=\"12\" y2=\"12\"><\/line><line x1=\"12\" y1=\"8\" x2=\"12\" y2=\"8\"><\/line><\/svg><p class=\"wp-block-advanced-gutenberg-blocks-notice__title\">Information<\/p><p class=\"wp-block-advanced-gutenberg-blocks-notice__content\"><strong><em>Note: This article, which was originally published in 2019, has been updated to include related news &amp; media resources<\/em><\/strong>.<\/p><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">For Google and Facebook, the losses totaled more than <strong>$100\nmillion<\/strong>. Belgium\u2019s Creland Bank handed over more than <strong>$75 million<\/strong> to\ncybercriminals. And the Austrian aerospace parts maker FACC lost <strong>$61 million<\/strong>.\nWhat\u2019s causing these types of massive losses? Each of these organizations were\nthe victims of <a href=\"https:\/\/www.thesslstore.com\/blog\/the-dirty-dozen-the-12-most-costly-phishing-attack-examples\/\">different\n(and costly) types of phishing attacks<\/a>. <\/p>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12779\"><\/span>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-what-s-a-phishing-attack\">What\u2019s a Phishing Attack?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In general, a phishing scam is a type of cyberattack that\ncybercriminals use to get users to perform some type of action. These emails\nare often sent out in mass with the goal of tricking unsuspecting individuals\ninto falling for their scam. Think of your best bud \u2014 the Nigerian Prince who\nkeeps trying to get you to take his money for \u201csafe keeping.\u201d <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, phishing has evolved significantly since his royal highness\nfirst entered the scene. There is now a variety of phishing attacks targeting\nbusinesses each day. Some involve the use of emails and websites; others may\nuse text messages or even phone calls. Attacks use these methods with the goal\nof getting users to provide personal or account information or to make wire\ntransfer funds to fraudulent accounts. The cybercrime industry is reaching unprecedented\nlevels. Cybersecurity Ventures reports that the <a href=\"https:\/\/cybersecurityventures.com\/cybercrime-damages-6-trillion-by-2021\/\">damages\nof cybercrime<\/a> are expected to cost the world <strong>$6 trillion annually by\n2021<\/strong> \u2014 of which phishing is anticipated to play a significant role. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But when we talk about phishing, what types of phishing\nattacks are we specifically talking about? There are actually multiple types of\nphishing scams that businesses are targeted by on a daily basis. <\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"What is phishing? Learn how this attack works\" width=\"960\" height=\"540\" src=\"https:\/\/www.youtube.com\/embed\/Y7zNlEMDmI4?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-10-types-of-phishing-attacks-that-can-snare-your-business\">10 Types of Phishing Attacks That Can Snare Your Business<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As you can probably tell from reading our blog posts, we\nlike lists. A lot. In this case, we\u2019ve put together a list of the most\nprevalent types of phishing attacks. The goal here is to help familiarize you\nwith many of the different types of phishing attacks that exist and provide an\noverview of how they work or what sets them apart from other phishing scams.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Just note that we have them in alphabetical order and not in\nany particular order of importance. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now that we have that out of the way\u2026 Let\u2019s dive in.&nbsp; <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-1-ceo-fraud-business-email-compromise\">1. CEO Fraud\/Business Email Compromise<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The first type of phishing we\u2019ll discuss is known as <a href=\"https:\/\/www.sans.org\/security-awareness-training\/resources\/ceo-fraudbec\">CEO\nfraud<\/a>. In a nutshell, CEO fraud occurs when a cybercriminal sends an email\nto a lower-level employee \u2014 typically someone who works in the accounting or\nfinance department \u2014 while pretending to be the company\u2019s CEO or another\nexecutive, manager, etc. The goal of these emails is often to get their victim\nto transfer funds to a fake account. Just a bit of bonus info for your upcoming\ntrivia night: In the U.S., CEO fraud is often referred to as business email\ncompromise (BEC), which the FBI says costs businesses billions of dollars.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For your viewing pleasure, I\u2019ve included a real example of a\nCEO fraud email that I received from someone trying to be The SSL Store&#x2122;\u2019s\nCEO John Tuncer:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" width=\"732\" height=\"317\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/CEO-Fraud-Example.png\" alt=\"\" class=\"wp-image-11133\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/CEO-Fraud-Example.png 732w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/CEO-Fraud-Example-300x130.png 300w\" sizes=\"auto, (max-width: 732px) 100vw, 732px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">In this case, it was easy for me to tell that it wasn\u2019t from\nhim. For one, the email sender is listed as John Tuncer, but the email address\nisn\u2019t his email account. Second, look at how the email is written \u2014 there is no\nspace between the first section of the sentence and the second part. This is\noften the case when information is being copied and pasted. Additionally, typos\nare as common in emails as there are weeds in a field. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Third, at The SSL Store, we use email signing certificates\nto authenticate all of our employees. This email lacks any sort of digital\nsignature or security measure. We\u2019ll speak more about email signing\ncertificates later in the article. <\/p>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12768\"><\/span>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-2-clone-phishing\">2. Clone Phishing<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"196\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Cloning-300x196.png\" alt=\"\" class=\"wp-image-11140\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Cloning-300x196.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Cloning.png 639w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The idea behind a <a href=\"https:\/\/www.csoonline.com\/article\/3234716\/types-of-phishing-attacks-and-how-to-identify-them.html\">clone\nphishing<\/a> attack is to take advantage of legitimate messages that the victim\nmay have already received and create a malicious version of it. The attack\ncreates a virtual replica of a legitimate message \u2014 hence, the attack\u2019s clever\nname \u2014 and sends the message from an email address that looks legitimate. Any\nlinks or attachments in the original email are swapped out for malicious ones. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The cybercriminal often uses the excuse that they\u2019re re-sending\nthe original message because of an issue with the previous email\u2019s link or\nattachment to lure end-users into clicking on them. We wish we could say that\nthis doesn\u2019t work; unfortunately, though, it often does because it catches\nusers unawares. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-3-domain-spoofing\">3. Domain Spoofing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The next type of phishing we want to mention is known as <a href=\"https:\/\/www.barracuda.com\/glossary\/domain-spoofing\">domain spoofing<\/a>.\nThis method of attack uses either email or fraudulent websites. Domain spoofing\noccurs when a cybercriminal \u201cspoofs\u201d an organization or company\u2019s domain to: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>make their emails look like they\u2019re coming from\nthe official domain, or<\/li>\n\n\n\n<li>make a fake website look like the real deal by\nadopting the real site\u2019s design and using either a similar URL or <a href=\"https:\/\/www.thesslstore.com\/blog\/unicode-domain-phishing\/\">Unicode\ncharacters<\/a> that look like ASCII characters. &nbsp;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">How\u2019s that possible? In the case of an email-based attack, a\ncybercriminal forges a new email header that makes it appear like the email is\noriginating from a company\u2019s legitimate email address. In a website domain\nspoof, the cybercriminal creates a fraudulent website and with a domain that\nlooks legitimate or is close to the original (apple.com vs apple.co, for\nexample). <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-4-evil-twin\">4. Evil Twin<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Evil-Twin.png\" alt=\"\" class=\"wp-image-11136\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">While it sounds like it would be up the same alley as a\nclone phishing attack, an evil twin is actually a very different animal. Unlike\nthe other methods of phishing we\u2019ve mentioned in this article, an evil twin\nattack is a form of phishing that capitalizes on Wi-Fi. TechTarget.com\ndescribes an <a href=\"https:\/\/searchsecurity.techtarget.com\/definition\/evil-twin\">evil twin<\/a>\nas \u201ca rogue wireless access point that masquerades as a legitimate Wi-Fi access\npoint so the attacker can gather personal or corporate information without the\nend-user\u2019s knowledge.\u201d This type of attack has also been referred to as the\nStarbucks scam because it often takes place in coffee shops.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.lifewire.com\/dangers-of-evil-twin-wi-fi-hotspots-2487659\">Evil\ntwin phishing<\/a> involves a cybercriminal creating a Wi-Fi hotspot that looks\nlike the real one \u2014 they\u2019ll even use the set service identifier (SSID) that is\nthe same as the real network. When end-users connect, the attacker can then\neavesdrop on their network traffic and steal their account names, passwords,\nand view any attachments that the user accesses while connected to the\ncompromised hotspot. (Tip: <a href=\"https:\/\/vpnstore.com\/how-a-vpn-protects-you-on-public-wifi\/\">A VPN will\nkeep your data secure even on a compromised Wi-Fi network<\/a>.)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-5-https-phishing\">5. HTTPS Phishing<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/HTTPS-Phishing-300x300.png\" alt=\"\" class=\"wp-image-11137\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">We recently wrote about how <a href=\"https:\/\/www.thesslstore.com\/blog\/https-phishing-the-rise-of-url-based-attacks\/\">URL-based\nattacks are on the rise<\/a>. In fact, <a href=\"https:\/\/www.thesslstore.com\/blog\/58-of-phishing-websites-now-use-https\/\">58%\nof all phishing websites<\/a> are now served via HTTPS. The approach\ncybercriminals use in these attacks is to send an email with only a\nlegitimate-looking link in the email body. There\u2019s often no other content\nexcept for the link itself (which may be clickable or a non-active link that requires\nthe recipient to copy-and-paste the URL into their web address bar. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So why would anyone intentionally click on such an email?\nThe short answer is because the attacker uses a variety of social engineering\ntactics to trick the email recipient into clicking on the link or\ncopy-and-pasting the URL into their web browser (which makes this type of\nphishing email difficult for filters to detect). This includes sending the\nmessages from an email address that appears legitimate \u2014 such as from the\nrecipient\u2019s boss, co-worker, or the CEO. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-6-smishing\">6. Smishing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SMS phishing, or \u201c<a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-smishing-definition-examples-protection-tips\/\">smishing<\/a>,\u201d is a form of phishing that capitalizes on the world\u2019s addiction to text messaging and instant communications. Ever receive a text message from Chipotle? How about Ticketmaster? Smishing is a way for cybercriminals to lure users into downloading malicious payloads by sending text messages that appear to come from legitimate sources and contain malicious URLs for them to click on. It could be something disguised as a coupon code \u2014 20% off your next burrito purchase \u2014 or it could be an offer to win free tickets to an upcoming show.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One way to avoid falling victim to smishing attacks is to\nrefer to the <a href=\"https:\/\/usshortcodedirectory.com\/\">U.S. Short Code\nDirectory<\/a> \u2014 yes, such a thing does exist \u2014 to see whether the message is\nbeing sent from a legitimate source. The best way to avoid it, however, is to\nnot engage with any unsolicited text messages. If you didn\u2019t sign up for text\nnotifications, don\u2019t click on the URL when you receive such a text. When in\ndoubt about the authenticity of a message, simply rely on the lesson your\nparents and\/or teachers taught you as a child: don\u2019t talk to strangers.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-7-spear-phishing\">7. Spear Phishing<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"270\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Spearphishing-300x270.png\" alt=\"\" class=\"wp-image-11142\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Spearphishing-300x270.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Spearphishing.png 644w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">A <a href=\"https:\/\/www.thesslstore.com\/blog\/spearphishing-compromises-two-florida-counties-voter-databases\/\">spear\nphishing attack<\/a> is a targeted form of phishing. Unlike general phishing\nemails, which use spam-like tactics to blast thousands of people in massive\nemail campaigns, spear phishing emails target specific individuals within an\norganization. They use social engineering tactics to help tailor and\npersonalize the emails to their intended victims. They may use email subject\nlines that would be topics of interest to the email recipients to trick them\ninto opening the message and clicking on links or attachments.&nbsp; <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Why is spear phishing so important? Because <a href=\"https:\/\/www.thesslstore.com\/blog\/80-eye-opening-cyber-security-statistics-for-2019\/\"><strong>91%\nof cyberattacks<\/strong><\/a><strong> start with a spear phishing email<\/strong>. The goal is\noften to steal data or to install malware onto the recipient\u2019s computer to gain\naccess to their network and accounts. Unfortunately, traditional security\nmethods may not stop these types of attacks because they are so highly\ncustomized that many traditional spam filters might miss them. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-8-vishing\">8. Vishing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You already read about smishing and understand that it\u2019s\nphishing for SMS messaging. So, if you\u2019ve guessed that \u201cvishing\u201d is \u201cvoice\nphishing\u201d (phishing over the phone), then you\u2019re be correct. A vishing attack\noccurs when a criminal calls your phone to try to get you to provide personal\nor financial information. They often use automated calls that re-route\nindividuals who fall for their tactics and end up speaking with the criminals\nthemselves. They also use mobile apps and other techniques to spoof their phone\nnumber or to hide their phone numbers entirely.&nbsp;\n<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These attackers frequently use a variety of social\nengineering tactics to trick you into providing this information. They also are\nknown to pretend to be someone else \u2014 the IRS, your bank, or an executive at\nyour company who claims to work at another branch. They\u2019ll claim that you owe\ntaxes, or that your credit card has suspicious activity and needs to be shut\ndown right away&#8230; they\u2019ll first just need to \u201cverify\u201d your personal\ninformation before they can close the card and reissue a new one. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Don\u2019t fall for these tactics. &nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-9-watering-hole-phishing\">9. Watering Hole Phishing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This lesser-known type of phishing attack is reminiscent of\na scene from the animal kingdom. Picture a group of zebras, antelope, and other\ncreatures on the Serengeti at a watering hole. To cool themselves, they edge\nnearer to the water and lean in to take a drink. One zebra decides to get a\nlittle cooler and wanders a little too far from the herd into the water. Suddenly,\na crocodile bursts up from beneath the surface of the water and grabs them, dragging\nthem under.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yeah, you\u2019ve guessed it: You\u2019re the striped dinner in this\nscenario. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" width=\"614\" height=\"339\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Watering-Hole.png\" alt=\"\" class=\"wp-image-11138\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Watering-Hole.png 614w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Watering-Hole-300x166.png 300w\" sizes=\"auto, (max-width: 614px) 100vw, 614px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/securityboulevard.com\/2018\/04\/beware-of-watering-hole-attacks\/\">Watering\nhole phishing attacks<\/a> target businesses by: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>identifying specific websites that your company\nor employees visit most often, and <\/li>\n\n\n\n<li>infecting one of the sites with malware. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The sites that are selected for infection might be a vendor\nwhose services your company uses. The goal is to infect the websites so that\nwhen you or your employees visit, your computers will automatically be loaded\nwith malware. This will provide the attackers with access to your network,\nservers, and sensitive information such as personal and financial data. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Will other people who visit the infect site fall victim to\nthe attack? Sure. But they\u2019re just collateral damage and extra victims for the\ncybercriminals. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-10-whaling\">10. Whaling<\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Whaling.png\" alt=\"\" class=\"wp-image-11139\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/digitalguardian.com\/blog\/what-whaling-attack-defining-and-identifying-whaling-attacks\">Whaling<\/a>,\na form of spear phishing, is a lot like the inverse version of CEO fraud. Instead\nof targeting lower-level individuals within an organization, the cybercriminal\ninstead targets high-level executives such as CEOs, CFOs, and COOs. The goal is\nto trick the executive into revealing sensitive information and corporate data.\nThese targets are carefully selected because of their access and authority\nwithin an organization. These attacks often use email and website spoofing. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Unlike general phishing emails, these messages rely on\nsocial engineering tactics using information they get from the internet and\nvarious social media platforms. They\u2019re highly tailored to their audiences and\noften include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The victim\u2019s name,<\/li>\n\n\n\n<li>Job title, and<\/li>\n\n\n\n<li>Basic details that make the communications look\nlegitimate.&nbsp; <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">There are other types of phishing attacks \u2014 evil twin,\nsnowshoeing\u2014 but we\u2019d keep you here all day if we kept talking about all of\nthem.&nbsp; <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-you-can-avoid-falling-for-many-types-of-phishing-attacks\">How You Can Avoid Falling For Many Types of Phishing Attacks<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Truly effective cybersecurity is a multi-layered approach. Here\nare some of the things you can do to help prevent your business from becoming\nthe next phishing-related headline: <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-train-your-employees-to-adopt-email-best-practices\">Train Your Employees to Adopt Email Best Practices<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This should go without saying, but it bears repeating since this\nstill seems to be a sticking point for some businesses: train your employees.\nAll of them. This includes everyone from the janitors to the CEO. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-implement-the-use-of-email-signing-certificates\">Implement the Use of Email Signing Certificates<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">As I mentioned earlier for the CEO fraud section, we use <a href=\"https:\/\/www.thesslstore.com\/products\/email-document-signing-certificates.aspx\">email\nsigning certificates<\/a> here at the SSL Store&#x2122;. These digital security\ncertificates are known as S\/MIME certificates because they use\nsecure\/multipurpose internet mail extensions to encrypt the content of our\nemails (and any attachments) and to digitally sign our communications. <\/p>\n\n\n\n\n\n<p class=\"wp-block-paragraph\">Below is an example of an email that my boss sent to me\nusing his email signing certificate:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"843\" height=\"151\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Signed-Email.png\" alt=\"\" class=\"wp-image-11143\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Signed-Email.png 843w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Signed-Email-300x54.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Signed-Email-768x138.png 768w\" sizes=\"auto, (max-width: 843px) 100vw, 843px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Below the \u201cFrom\u201d and \u201cTo\u201d fields, it says the email is\n\u201cSigned By\u201d and lists Adam\u2019s email address. To the right, you\u2019ll notice a small\nribbon icon. When you hover over the graphic, it displays a message that says\n\u201cDigital Signature is trusted. Click here for details.\u201d When you click, it\ndisplays the following notification: <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" width=\"356\" height=\"242\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Email-Signing-Certificate-Display-Message.png\" alt=\"\" class=\"wp-image-11134\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Email-Signing-Certificate-Display-Message.png 356w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Email-Signing-Certificate-Display-Message-300x204.png 300w\" sizes=\"auto, (max-width: 356px) 100vw, 356px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">When you click on \u201cDetails,\u201d it breaks down the encryption\nand digital signature security layers for additional information. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" width=\"357\" height=\"472\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Additional-Info.png\" alt=\"\" class=\"wp-image-11141\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Additional-Info.png 357w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Additional-Info-227x300.png 227w\" sizes=\"auto, (max-width: 357px) 100vw, 357px\" \/><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-other-tips-for-preventing-many-types-of-phishing-attacks-include\">Other Tips For Preventing Many Types of Phishing Attacks Include:<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Using a password manager<\/strong> \u2014 A trusted\npassword manager enables your employees to have and use complex and secure\npasswords for every account without the hassle of having to remember all of\nthem. <\/li>\n\n\n\n<li><strong>Turn on two-factor authentication (2FA)<\/strong> \u2014\nThis protective measure requires multiple pieces of information for someone to\nbe able to log in. It requires two of the following:\n<ul class=\"wp-block-list\">\n<li>Something you know (a password, passphrase,\netc.);<\/li>\n\n\n\n<li>Something you have (a mobile app, a smart card,\na personal token, etc.); and\/or <\/li>\n\n\n\n<li>Something you are (biometrics such as a retinal\nscan, fingerprint, etc.). <\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Using a sender policy framework (SPF)<\/strong> \u2014\nThis is a type of email validation system that allows domain managers to\nauthorize specific hosts to use a domain.<\/li>\n\n\n\n<li><strong>Verifying suspicious communications through\nofficial channels<\/strong> \u2014 If you receive a phone call from someone claiming to be\nyour bank, hang up and call your bank directly using the phone number on the\nback of your card. If you receive an email from someone claiming to be the CEO\nwho wants you to transfer money, send sensitive data or anything else even remotely\nsuspicious, call them or their assistant on an official company phone line.\nDon\u2019t ever rely on the contact information provided in a suspicious\ncommunication. <\/li>\n\n\n\n<li><strong>Using websites that are secure and encrypted<\/strong>\n\u2014 Ensure that your website \u2014 and those that you visit \u2014 are secure and\nencrypted. This means visiting websites that use secure protocols (HTTPS)\ninstead of insecure ones (HTTP). You can secure your website using <a href=\"https:\/\/www.thesslstore.com\/products\/ssl.aspx\">SSL\/TLS certificates<\/a>,\nwhich protect the data that is transmitted between your site and your\nend-users\u2019 web browsers. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>As always, leave any comments or questions below\u2026<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-recent-related-news\">Recent Related News<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Updated on March 2, 2021<\/em><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.pasadenanow.com\/main\/dmv-warns-customers-of-phishing-scam\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">DMV Warns Customers of Phishing Scam \u2013 Pasadena Now<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/ransomware-phishing-will-remain-primary-risks-in-2021\/d\/d-id\/1340256\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Ransomware, Phishing Will Remain Primary Risks in 2021<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.sacbee.com\/news\/politics-government\/capitol-alert\/article249619058.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Get a text asking for personal info for REAL ID? It\u2019s a scam, California DMV says<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>There&#8217;s more than just one type of phish. Knowing what to look for can help your organization from getting swallowed. Here are 10 different types of phishing.<\/p>\n","protected":false},"author":17,"featured_media":11132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16,10200,13114],"tags":[166],"class_list":["post-11129","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","category-monthly-digest","category-updated","tag-phishing","post-with-tags"],"views":113528,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Types-of-Phishing-Feature.png","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=11129"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11129\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/11132"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=11129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=11129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=11129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}