Staying safe from phishing attacks
What is phishing?
Phishing is a form of social engineering1 in which a cybercriminal tries to fool people into revealing personal information online.2 The name comes from the idea of fishing: Scammers send a message that acts as bait, hoping to “hook” someone.
Phishing attacks use email, websites or text messages to trick you into giving personal information.3 The sender seems to be a trusted person or group. This may encourage you to click on a link. The link may infect your phone or computer with malware and viruses.4
For example, an attacker may send an email that looks like it’s from a real credit card company or a bank. The email may ask for your account information, often saying there is a problem. Attackers often take advantage of current events and certain times of the year, such as:
- Natural disasters (e.g., hurricanes)
- Health care or insurance scams (e.g., Medicare enrollment, COVID-19)
- Economic problems (e.g., IRS or Social Security scams)
- Major political elections
- Holidays (e.g., Valentine’s Day, Independence Day)
How is phishing different from spam emails?
Spam is any unsolicited email that arrives in your inbox.5 Spam is another word for unwanted or junk mail that is sent out to a large group of people.5 While it is usually sent for commercial purposes, it can come from networks of infected computers.5
A small number of spam emails are phishing emails sent by cybercriminals. The emails may look like spam, but if you click on a link or open an attachment, they may install harmful malware.3
Responding to these emails may lead to identity theft, email fraud, a ransomware attack on your business or any number of other devastating consequences.
There are several things you can do if you suspect you are being targeted by an email phishing scam. If you suspect the spam email you’ve received is a phish:
- Do not click on any links in the email
- Do not download any attachments
- Do not reply
- Beware of emotional traps, like promises of rewards or threats for not acting
Update your devices often to make them more secure. Try using two-factor authentication to make your devices more secure.3
Check out the Spam Email or Phishing Attack infographic for more great tips on spotting and avoiding phishing.
Awareness is the best defense
Verify the sender
Were you expecting something from them? Check the sender’s email address. If the email address has characters that aren’t on the company’s main website, it could be a fake email. It may be an email address that does not reference the company at all or that alters the official name in some way. You can always call the company to verify that they sent the email.
What is in the message?
Is the tone urgent? Are there grammatical or spelling errors? If so, be suspicious.
Look for links or QR codes
If the email or text tries to get you to click on links or scan a QR code to visit a website and provide information, beware. Make sure the sender is someone you trust before clicking a link or scanning a code. QR codes should be treated with care since it can be difficult to discern where they point before scanning them.
Confirm
Check the request by phone with the office of the person or system mentioned.
Read more: Visit the Consumer Financial Protection Bureau website for more information related to common fraud and scams and how you can avoid them.
Share
