The Truth
As an IT company we are professionals in mitigating risks associated with cyber threats, however it is important to understand a critical truth. While robust cyber security measures are essential, personal awareness is just as crucial.
Over the past few months, we’ve observed a rise in email phishing incidents affecting some of our clients. Many of these incidents involved employees who were unaware of how to respond appropriately. While we successfully addressed and mitigated these threats, it underscores the fact that each individual serves as the final barrier against cyber threats. Their awareness and actions can significantly impact their company’s security.
Recognizing and Avoiding Popular Email Scams
Email scams pose one of the, if not the, biggest threats to individuals within an organization. This is particularly critical because using a business email connected through the organization means that if attackers gain access to one account, they could potentially access the entire organization. Cyber criminals understand that targeting unaware employees within organizations is often the most effective way to gain access to sensitive data, financial information, or valuable intellectual property through email scams.
Listed below are seven of the most common email scams that we have observed among our clients this year. It is crucial to be able to recognize and respond to emails like these appropriately to safeguard against potential cyber threats.
1. Account Suspension Threat
Subject: Immediate Action Required: Verify Your Account Details to Prevent Suspension
Dear Customer,
We are contacting you to notify you that your account is currently under review due to suspected unauthorized access. To avoid immediate suspension, please click the link provided below to verify your account details. This step is crucial for confirming your identity and securing your account against potential security threats.
Malicious Link
We appreciate your swift action on this matter and apologize for any inconvenience caused. Thank you for your continued trust in our services.
__
Name
Company Name
email@email.com
To: Youremail@email.com
How to Avoid it
- Check sender email domains carefully for spoofing.
- Never click links in unexpected emails. Navigate to sites manually.
2. Tech Support
Hello,
We trust this message reaches you in good health. Our system diagnostics have identified a critical issue within your account that demands immediate attention to prevent potential data loss and service interruption.
To resolve this issue promptly, please contact our dedicated support team at [Fake Support Number] or click the link below to initiate a remote session with our technicians. They will assist you with the necessary steps to address this matter efficiently.
Malicious Link
Your swift response is essential to maintain the stability and security of your account. We apologize for any inconvenience caused and thank you for your cooperation.
__
Name
Company Name
Subject: Critical System Alert: Urgent Action Needed to Prevent Data Loss
email@email.com
To: Youremail@email.com
How to Avoid it
- Verify directly with official IT support using contact information directly from the official website.
- Never Grant Remote Access. Legitimate tech support companies will never ask for remote access to your computer unsolicited.
Name,
We hope this message finds you well. We regret to inform you that your recent invoice #[Fake Invoice Number] remains unpaid and is now overdue. To avoid late fees and potential legal actions, we kindly ask you to settle the outstanding amount by clicking the link below. You can review the invoice details in the attached PDF document.
Malicious Link
Your prompt attention to this matter is greatly appreciated. Should you have any questions or need further assistance, please do not hesitate to contact our billing department.
__
Name
Company Name
Subject: Unpaid Invoice; Requires Immediate Attention
email@email.com
To: Youremail@email.com
How to Avoid it
- Do not let urgent or threatening language pressure you into making quick payments on suspicious invoices.
Verify invoices by accessing your official account dashboard directly, or even calling the company.
Ensure the business names on invoices are spelled correctly and match the official names exactly.
4. Suspicious Activity
Name,
We regret to inform you that we have detected suspicious activity on your windows account. Our security systems have flagged unauthorized access attempts, potentially compromising your personal information.
To prevent further security breaches and to reinstate your account, please click on the following link to verify your identity and reactivate your account securely:
Malicious Link
Please note that failure to verify your account within 24 hours will result in permanent termination, and you may lose access to critical Microsoft services and data associated with your account.
We take your security seriously and apologize for any inconvenience caused. Thank you for your prompt attention to this matter.
__
Sincerely,
Microsoft Security Team
Subject: Suspicious Activity Detected
email@email.com
To: Youremail@email.com
How to Avoid it
- Verify through official channels.
- Hover over links: Do not click on any links in an email attachment if you are unsure of its legitimacy.
- Enable Two-Factor Authentication (2FA): Add an extra layer of security to your accounts by enabling 2FA. This can prevent unauthorized access even if your password is compromised.
5. Human Resources (HR)
Good Morning,
Please take a moment of your time to direct your attention to the link below that outlines the changes in our rules of conduct that our company expects from all its employees.
Please complete the form and send an electronic copy to the HR office no later than the end of the day tomorrow.
Malicious Link
__
Regards
HR Department
Subject: Unpaid Invoice; Requires Immediate Attention
email@email.com
To: Youremail@email.com
How to Avoid it
- Contact HR directly, using official contact information (not the contact details provided in the email).
- Verify with coworkers. Speak in person or use trusted communication channels. Chances are your coworkers have not received the same email.
- Check for Grammer or spelling mistakes.
6. Payment Confirmation
Name,
A payment has been made to your account. You can review your receipt below. Thank you for your purchase.
Malicious Link
__
Best Regards,
Company Name
Subject: Order Confirmation
email@email.com
To: Youremail@email.com
How to Avoid it
Verify the payment: log into your account through the official website or bank to see if a payment or receipt appears there.
- Contact the company directly. Only using contact information directly from the company’s official website.
Dear Name,
We hope this message finds you well. As you may know, millions of children around the world still lack access to clean drinking water, and we need your help to make a difference.
Our organization, Clean Water for Children, is launching an urgent campaign to provide safe and clean drinking water to communities in desperate need. We are reaching out to generous individuals like you to help us achieve our goal.
Every donation counts, and with your support, we can:
- Provide educational programs about hygiene and sanitation
- Distribute clean water supplies to families in need
Malicious Link
Together, we can create a brighter and healthier future for these children. Please donate now and share this message with your friends and family to spread the word. Thank you for your support.
__
Best Regards,
John Doe
Clean Water for Children
Subject: Unpaid Invoice; Requires Immediate Attention
email@email.com
To: Youremail@email.com
How to Avoid it
Research the Charity: Lookup the charity on reputable sites to confirm its legitimacy. If you choose, donate directly through the site.
- Be skeptical of high-pressure tactics: Scammers often use emotional stories to manipulate you into donating quickly. Take time to verify the story efficiently.
- Check for red flags: Spelling and grammatical errors.
Can You Spot it?
Have you ever received a phishing email similar to any of the examples? Our hope is that you were able to spot it right away. As we work behind the scenes as your cyber security experts, we want to make sure equipped with the knowledge to protect yourself and your organization from these common threats.
Today, the ability to spot and dodge phishing emails isn’t just a skill, it’s a crucial defense for your organization’s cybersecurity. Each employee becomes the last line of defense against cyber threats. By recognizing red flags like phony account suspension notices, deceptive tech support pleas, individuals can play a pivotal role in shielding their company’s sensitive data. Contact CATS Technology Solutions Group to get started on cyber training today.
