Phishing attacks have used the same general concepts since attackers began using the method, but the design element has evolved so much that some schemes are nearly impossible to catch.
I received the following email in my work inbox yesterday. I write stories about phishing schemes regularly, so I knew exactly what it was. But check out how realistic it looks.
The email even links directly to the official Apple website, which makes it seem legitimate. Cyber-criminals are apparently after Apple login credentials, and they're not stopping with email. A recent report from Graham Cluley reveals that Apple users are also receiving SMS messages from phishers. The messages warn users that their Apple ID will expire soon, and direct them to a fake link.
It's not just Apple users
Everyone from the CIA to Chase Bank has fallen victim to phishing schemes, and it's easy to see why. These messages look pretty convincing, and it can seem almost impossible to separate real from fake.
According to a 2015 Verizon report, the effectiveness of phishing schemes continues to climb, with an estimated 11% of recipients actually clicking on attachments in phishing emails.
"Now, these messages are rarely sent in isolation—with some arriving faster than others. Many are sent as part of a slow and steady campaign. The numbers again show that a campaign of just 10 emails yields a greater than 90% chance that at least one person will become the criminal's prey, and it's bag it, tag it, sell it to the butcher (or phishmonger) in the store," the report states.
What can you do?
According to Phishing.org, these are the steps to take in order to protect yourself.
- Check the email carefully
- Never enter financial or personal information
- Protection through software
- Never send personal information through emails
- Check bank details regularly
- Never download files from unreliable sources
While these steps may seem like common sense, this is something that employers should not take lightly. Encourage employees to report any suspicious emails, and provide continuous training on phishing. Criminals will no doubt continue to evolve, and it's up to us to stay one step ahead.
