In some ways, Phishers make the fictional Grinch look as good and kind-hearted as Dolly Parton<\/a>. Recent phishing statistics<\/a> show the devastating costs associated with phishing scams. But until these cybercriminals are arrested \u2014 and, ideally, get prosecuted<\/a> \u2014 they\u2019re free to wreak havoc on unsuspecting consumers and organizations alike.<\/p>\n\n\n\n Knowing this, we\u2019ve asked four industry experts to share their best phishing awareness tips for businesses and consumers. Ideally, these insights will enlighten and help prevent you and your company from being scammed during the holidays (and in the year to come). <\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span>\n\n\n We asked our group of experts to define \u201cphishing awareness.\u201d While there are differences in terms of how it\u2019s commonly defined for consumers versus organizations, there is some overlap as well.<\/p>\n\n\n\n Avesta Hojjati<\/strong><\/a>, Chief Technology Officer at SecurityScorecard, describes phishing awareness as \u201cthe ability to recognize and respond appropriately to deceptive attempts, typically via email or messaging (e.g., WhatsApp or SMS), aimed at stealing sensitive information or gaining unauthorized access.\u201d<\/p>\n\n\n\n Similarly, Jacob Duane<\/strong><\/a>, CEO at the email security and deliverability firm Stellastra, says that phishing awareness boils down to being familiar with the deceptive actions and behaviors associated with social engineering. \u201cThe primary objective of it is to cultivate a proactive mindset toward cybersecurity threats by educating individuals and organizations on how to effectively detect and respond to phishing attempts.\u201d<\/p>\n\n\n\n Another expert, Dave Hatter<\/strong><\/a>, Cyber Security Consultant at Cincinnati-based IT company Intrust IT, broke things down more in terms of phishing awareness for businesses and organizations versus consumers:<\/p>\n\n\n\n Let\u2019s jump right into what you came here to read: 10 phishing awareness tips for businesses and consumers. After that, we\u2019ll cover a handful of the most common phishing scams and explore what makes people more susceptible to them.<\/p>\n\n\n\n Providing regular cyber security training can help employees keep cyber security threats top of mind. However, Duane encourages companies to move beyond annual security awareness training that just checks the box. Companies can make training more valuable by enhancing it with phishing simulations that enable companies to not only monitor progress but also provide more focused training.<\/p>\n\n\n\n Furthermore, these simulations also give companies an opportunity to provide additional timely trainings based on demonstrated gaps in phishing awareness and knowledge:<\/p>\n\n\n\n \u201cJust-in-time learning is particularly effective: it ensures that more phishing-aware staff don’t feel their time is wasted while offering immediate training for those who fall for a simulated phishing email. If an employee clicks a malicious link or downloads an attachment during a simulation, they can instantly receive targeted training to address their phishing awareness blind spots.\u201d \u2014 Jacob Duane<\/em><\/p>\n<\/blockquote>\n\n\n\n Related Resources: Cybersecurity & Phishing Awareness Training<\/strong><\/p>\n\n\n\n All the experts agree that phishing tests are a great way to gauge your employees\u2019 cyber awareness and their ability to put that knowledge to use. Hojjati said that hosting regular, realistic phishing simulations is a great way to help prepare employees to face these real-world threats in a safe environment.<\/p>\n\n\n\n Hatter agrees and recommends companies implement these tests often:<\/p>\n\n\n\n \u201cInstitute unannounced phishing simulations on a regular cadence (at least monthly) to train staff in on what to look for and how to react. This helps employees learn through experience, improving their response to actual phishing attempts and reinforcing previous learning as well as the importance to being aware and prepared.\u201d \u2014 Dave Hatter<\/em><\/p>\n<\/blockquote>\n\n\n\n Phishing attack simulations<\/a> can be done in-house or by hiring third-party vendors.<\/p>\n\n\n\n While regularly educating employees and testing their ability to apply the knowledge is important, building up these skills only solves part of your pain points. Employees also need a quick and easy way to report phishing concerns. Hojjati suggests establishing \u201cclear reporting protocols so employees know how to escalate suspected phishing attempts quickly.\u201d<\/p>\n\n\n\n However, employees need to feel confident that they can report such concerns without fear of reprisal if they admit that they fell for a phishing scam. Hatter has a suggestion for how to achieve this: \u201cDeploy an easy-to-use system for employees to report suspected phishing attempts. Ensure that employees are encouraged to report suspected phishing and provide feedback and insights in a non-judgmental way.\u201d <\/em><\/p>\n\n\n\n One approach is to provide a button in their email client that allows them reliably report suspicious messages quickly and easily. For example, by using a reporting button that\u2019s available through Microsoft Outlook email clients (pictured below):<\/p>\n\n\n\n Related resource:<\/strong> How to Report a Phishing Email in Apple Mail, Gmail, and Microsoft Outlook<\/a><\/p>\n\n\n\n Another approach is to set up a specific email account to forward suspicious messages to (e.g., soc@yourcompany.com<\/em> or phishing@yourcompany.com<\/em>).<\/p>\n\n\n\n Duane says describes multi-factor authentication as a way to add another layer of security to your employees\u2019 accounts: \u201cWhile not infallible, multi-factor authentication significantly reduces the risk of certain phishing attacks, particularly those aimed at stealing user credentials.\u201d<\/p>\n\n\n\n Hojjati adds to this that using unique authentication factors helps add another layer of protection to accounts, even if the credentials have already been compromised.<\/p>\n\n\n\n Jeremy Caban<\/strong>, a DevOps Engineer at TheSSLstore.com and our former IT administrator, emphasizes the importance of businesses using digital identities to their advantage.<\/p>\n\n\n\n \u201cIncorporating certificate-based digital identity into your emails goes a long way in strengthening your organization\u2019s email security. However, you must also educate employees, so they know where to look for these digital identities and how to verify their authenticity.\u201d \u2014 Jeremy Caban <\/em><\/em><\/p>\n<\/blockquote>\n\n\n<\/span>\n\n\n So, what are some examples of these methods? We talk about \u2018em frequently:<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Duane calls out the importance of businesses using email security protocols like the sender policy framework<\/a> (SPF), domainkeys identified mail<\/a> (DKIM), and domain-based message authentication, reporting, and conformance<\/a> (DMARC). However, he\u2019s quick to mention that they\u2019re not infallible.<\/p>\n\n\n\n \u201c<\/em>Every owner of the approximately 300 million custom domains in existence (e.g., amazon.com, thesslstore.com, shopify.com) is responsible for securing their domain against phishing by implementing <\/em>anti-spoofing protocols<\/em><\/a> like <\/em>SPF, DKIM, and DMARC<\/em><\/a>. Despite significant progress in recent years, full adoption of these protocols is still ongoing. All staff should understand that technical safeguards can fail.\u201d \u2014 Jacob Duane<\/em><\/p>\n<\/blockquote>\n\n\n\n This is why employees must rely on their cyber awareness, gained through training and testing, intuition, and digital identities to verify the authenticity of any outreach or request as much as possible.<\/p>\n\n\n\n We\u2019ve talked about ways that businesses and other organizations can beef up their organizations\u2019 cyber defenses by hardening their \u201chuman firewalls.\u201d But this brings us to addressing phishing awareness in another key group: consumers.<\/p>\n\n\n\n While it\u2019s true that phishing messages are becoming increasingly complex and believable, Caban emphasizes the importance of not overlooking the basic signs of phishing.<\/p>\n\n\n\n “Be on the lookout for anything out of the ordinary in the emails and texts you receive. For example, messages littered with typos, or that contain incorrect contact information or file attachments with unusual or gibberish names.” \u2014 Jeremy Caban<\/em><\/p>\n<\/blockquote>\n\n\n\n Trust your gut. If it says something\u2019s \u201coff\u201d or not right.<\/p>\n\n\n\n According to Hatter, demonstrating healthy skepticism can go a long way in helping you avoid falling for social engineering and phishing tactics. It\u2019s important to pause for a moment before acting.<\/p>\n\n\n\n \u201cSlow down, take a breath and always verify the legitimacy of emails, texts or social media about deals, shipping notifications, or requests for personal information. In other words, verify out of band, don\u2019t click the links, or call the phone numbers provided, instead directly visit the official website, or use another a known contact method before making a purchase, sharing sensitive information like credentials or downloading an app.\u201d \u2014 Dave Hatter<\/em><\/p>\n<\/blockquote>\n\n\n\n There may be times when you receive a text message or email from a friend or loved one that says something\u2019s wrong or that they need your help. When this happens, your initial instinct may be to jump straight into action to help them. But that emotional response is precisely what cybercriminals are counting on, and this can get you in trouble.<\/p>\n\n\n\n According to Duane:<\/p>\n\n\n\n \u201c<\/em>If you get strange texts from loved-ones, asking for money transfers, take measures which reduce risk, ask them knowledge-based questions. If they message you from a new number, try calling their old one, ask their friends and family to verify.\u201d \u2014 Jacob Duane<\/em><\/em><\/p>\n<\/blockquote>\n\n\n\n If someone sends you an unexpected text or email that expresses a sense of panic or urgency, ask yourself why. Hatter described urgency as a major red flag for consumers:<\/p>\n\n\n\n \u201cScammers use social engineering to create a sense of urgency that demands immediate action. If an email or message requires immediate action, assume it\u2019s a scam. Stop what you\u2019re doing, think about it, and then verify the legitimacy before responding or clicking any links. An ounce of prevention is worth a pound of cure.\u201d \u2014 Dave Hatter <\/em><\/p>\n<\/blockquote>\n\n\n\n The reason social engineers love to use urgency to their advantage is it gets people to act without thinking. This is why all of our experts agree that urgent messages should be treated immediately with suspicion and require stringent verification. Hojjati emphasizes the need to \u201cverify links by hovering over them before clicking. Trust but verify!\u201d<\/p>\n\n\n\n The holiday season is traditionally viewed as a time of giving and receiving gifts. This creates a perfect shipping scam opportunity for cybercriminals to exploit.<\/p>\n\n\n\n \u201c<\/em>People are sending more parcels around Christmas time. You might be more likely to open a phishing email about a parcel delivery, considering it to be either something you ordered, or something a distant family member may have sent to you.\u201d \u2014 Jacob Duane<\/em><\/p>\n<\/blockquote>\n\n\n\n However, it\u2019s important to remember that these shipping and parcel scams can happen any time of the year. Here\u2019s an example of a fraudulent message pretending to represent the United States Postal Service (USPS). The SMS text contains a fake URL message that starts with \u201cusps.com\u201d and then includes other false and unrelated domain-related information, which is a big red flag (see image). <\/p>\n\n\n\n There are plenty of common phishing scams that everyone must be aware of nowadays to avoid falling victim to them:<\/p>\n\n\n\nBefore Diving into Phishing Awareness Tips: What Is \u2018Phishing Awareness?\u2019<\/h2>\n\n\n\n
\n
Phishing Awareness Tips for Businesses and Other Organizations<\/h2>\n\n\n\n
Phishing Awareness Tip #1: Provide Regular and Just-in-Time Training<\/h3>\n\n\n\n
\n
\n
Phishing Awareness Tip #2: Conduct Regular Phishing Simulation Tests<\/h3>\n\n\n\n
\n
Phishing Awareness Tip #3: Make Reporting Phishing Easy<\/h3>\n\n\n\n
![\"An](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/07\/how-to-report-phishing-email-outlook-email-view2-shadow-1024x717.jpg\")
Phishing Awareness Tip #4: Use Digital Identity Verifications to Enhance Security<\/h3>\n\n\n\n
\n
\n
![\"An](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/12\/signed-email-example-phishing-awareness-tips-2.png\")
\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/10\/mark-certificates-in-email-examples-shadow.png\")
Phishing Awareness Tip #5: Teach Employees That Anti-Spoofing Tools Aren\u2019t Foolproof<\/h3>\n\n\n\n
\n
Phishing Awareness Tips for Consumers<\/h2>\n\n\n\n
Phishing Awareness Tip #1: Don\u2019t Overlook the Obvious Signs of Phishing<\/h3>\n\n\n\n
\n
Phishing Awareness Tip #2: Be Skeptical and Verify Using Other Channels<\/h3>\n\n\n\n
\n
Phishing Awareness Tip #3: Use Other Methods to Verify a Contact\u2019s Identity<\/h3>\n\n\n\n
\n
Phishing Awareness Tip #4: Pay Attention to Urgency<\/h3>\n\n\n\n
\n
Phishing Awareness Tip #5: Beware Fake Parcel Delivery Notices<\/h3>\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/12\/usps-phishing-sms-473x1024.jpg\")
\n
Top Scams Observed in 2024<\/h2>\n\n\n\n
\n