Phishing attempts happen constantly and can range from very simplistic to amazingly detailed and targeted. It is very important to understand some of the more common elements and also misconceptions surrounding emails to help avoid some of the pitfalls.
Elements to watch
- Phishing emails can look like they come from any source. A lot of attempts spoof email addresses for large companies or even email addresses within our own company. Just because an email appears to come from someone within our company doesn't mean that it really did.
- Phishers do not care about copywriting or other protected images and generally will make their emails look very authentic. Hovering over an image will sometimes display the link for the image and if it is coming from the actual company web address some other site.
- The text of a hyperlink can indicate something legit, but the actual URL that it redirects you to is not. Hovering over the hyperlink and paying very close attention to the URL can help determine if it is real or fake. Be careful because it may have something like www.connorgp.com.ca that will look close to a real internet address, but actually be a carefully crafted spoof.
What to do if something doesn't look or feel right
- Check with the person who supposedly sent the email and see if it was real or not, but don't reply to the suspicious message. Either create a new message or preferably use an alternate form of communication.
- Pay particular attention to the email address. Look for slight misspellings of names or domains. Look for odd variations of a company's expected domain name.
- If you're suspicious that a message is a phishing attempt, trust your instincts. Your instinct is probably correct, or the message is likely junk or spam.
- Report the message to CG Insider's IT support team for confirmation or feedback. This is most easily accomplished using the 'Phish Alert Report' button in Outlook:
.
- Above everything, if you're unsure at all, DO NOT click links or open attachments.