Initially posted by KnowBe4 on April 8th 2022
Social engineering and phishing are responsible for 70% to 90% of all malicious breaches , so it’s very important to keep a heightened state of alert against this type of cyber attack at all times.
Number One Most Suspicious Sign
If I had to pick the most important hint, the single most suspicious red flag to me is a strange-looking hyperlink which does not directly point to a valid, trusted domain; especially if it goes out of its way to fraudulently appear as if it points to a legitimate domain or trusted brand (e.g., microsoftustechsupport@outlook.com, techtalk@google.com.rogueserver.biz, returns.amazon@amazongproducts.ru, etc.). Always hover over ANY URL links and look for bogus links.
The second most important sign is simply recognizing unexpected requests, which if performed, could lead to something bad. It could be a request to do many different things, including:
- Open and read a document
- Click on a link
- Visit a website
- Provide login credentials
- Process an invoice
- Change banking or payroll information
- Buy gift cards
Stressor Events
Most phishing emails contain a “stressor event”, which is a statement from the sender that if the user doesn’t perform the requested action now, then there will be very negative consequences. For example, the invoice has to be bought now or the important business deal is off; or your password must be verified now otherwise your account will be permanently locked. Stop, look, and think before acting.