LoginIntroduction
In the real world we have developed practices to keep ourselves, our families and businesses safe from criminals. We lock car doors, secure home front doors, and you probably wouldn’t walk down a dark alley in a strange city late at night. Unfortunately we are still developing the digital equivalents of these best practices; many remain uncertain how to act safely.
Saving passwords in your browser, for example, is like leaving your car keys on the front seat; clicking unsolicited links is like walking alone down that dark alley. Companies have deployed Anti-Virus, Firewalls and other technologies — necessary, but not sufficient. Spam and phishing filters have a non-trivial failure rate; even a 7% gap can deliver a large number of malicious messages into employee inboxes.
Cyber criminals focus on humans because people remain the weakest link. A high proportion of breaches begin with a phishing attack, often using impersonation and social engineering (for example Business Email Compromise / CEO fraud). The financial impact can be catastrophic.
Eight Quickest Ways to Spot a Phishing Attack
-
1
The Message Contains a Mismatched URL
Hover over links to verify that the displayed text matches the actual link destination. If they differ, report it.
-
2
The URL Doesn’t Match the Domain
Watch for deceptive domains that include a legitimate brand as a subdomain (e.g. www.apple.scamwebsite.com).
-
3
The Sender Doesn’t Appear Legitimate
Check the full sender address. Many scams use generic providers (Gmail, Hotmail) rather than an official corporate domain.
-
4
Poor Spelling and Grammar
Legitimate corporate communications are usually reviewed. Obvious errors can be a reliable signal of fraud.
-
5
Content Requests Personal Information
Reputable organisations do not request sensitive personal or account details via an initial email.
-
6
Action Wasn’t Initiated by the Recipient
Unsolicited demands or requests are high-risk. Treat first-contact emails with caution unless previously authorised.
-
7
The Offer Is Too Good to Be True
Promises of extraordinary reward are classic lures. If it sounds implausible, ignore it.
-
8
The Message Contains Threats
Threats or urgent legal claims are commonly used to cause panic. Verify such claims independently; government agencies do not generally use email as a first contact for legal threats.
After reading this guide
You should now be aware of the common phishing indicators and the basic steps needed to protect yourself and your organisation. Technical controls reduce exposure, but staff training and regular assessment are essential to close the remaining gap.
