Don’t get hooked by Phishing scams

17th June 2013

Don’t get hooked by Phishing scams

Phishing, simply put, is a type of scam. It’s a fraudulent process by which an “attacker” attempts to steal your identity by acquiring sensitive information – such as your username, passwords, personal identity number, or credit card or bank details – by masquerading as a trustworthy entity.

Phishing attacks are occurring with increased frequency and with an increased level of sophistication. The risks are real both in a business environment and in your personal capacity.

Typically carried out via email, instant messaging and text messages, phishing frequently includes the use of proprietary logos and branding, such as a “from” line disguised to appear as if the message came from a legitimate sender. Phishing emails or messages usually contain a link to an authentic-looking website or email address that will capture information from the unsuspecting user. Without realising it people are falling for phishing attempts as these emails and websites are evolving and looking more authentic.

A more targeted form of this attack is called “Spear Phishing.” Unlike standard phishing schemes that use mass emails, these schemes target individuals that fit a certain profile. For example, they may only target people whom scammers believe to be affluent employees of a specific company or governmental agency, or users of a specific site. The aim of these attackers is to get the reader to divulge sensitive information about themselves and/or their organisation.

You can’t prevent phishing attempts; however you can reduce the risk of becoming a victim by following some simple steps:

• Do not assume that spam filters will catch all illegitimate emails. Even if it appears in your inbox, that does not mean it is genuine. Be alert to signs that the message is fraudulent, such as misspellings, poor grammar, and other irregularities. For example beware of emails addressed to ‘Dear Customer’; as a general rule these are scams of some type.

• Phishing attempts often ask for financial or personal information. Unless you have validated the source and the site, never provide personal or business information through a form on the Internet. Legitimate organizations do not ask you to verify your username or password via emails or text messages as they already have that information.

• Often Phishing emails have links to web addresses that are very similar to authentic websites including logos and branding. Never click on links in emails if you are suspicious. Instead:
o Hover your mouse over the link to see the actual URL (website address), which might be different from what shows up in the text
o Do not click on a link. Type (do not copy and paste) the company’s URL directly into a browser to determine if the request is legitimate.

• Do not open email attachments from unfamiliar sources. In particular, email attachments with “.scr,” “.com” and “.exe” file extensions may be malicious and could contain malware or a virus.

• Beware of random pop-up screens.

If you believe you have unwittingly become a victim of a phishing attack, remember to check your bank and credit card statements regularly to verify that no unauthorised transactions have taken place.

About KPMG
network of professional firms providing Audit, Tax and Advisory services. We operate in 156 countries and have more than 152,000 people working in member firms around the world. The independent member firms of the KPMG network are affiliated with KPMG International Cooperative ("KPMG International"), a Swiss entity. Each KPMG firm is a legally distinct and separate entity and describes itself as such.

ENDS

© Scoop Media