Tech Tips: Email Scams to Watch Out For

By Wesley Kirk

Introduction

In Strategic’s ongoing cybersecurity education series, we would like to discuss different email scams to look out for. Email attacks are a constant and evolving threat to organizations of all sizes, with phishing being the most prevalent form. While traditional phishing casts a wide net, targeting many recipients with generic messages, more sophisticated tactics, like spear phishing, take a highly personalized approach. Unlike typical phishing attempts, spear phishing involves attackers researching specific individuals, crafting emails that appear genuine, and often mimicking trusted colleagues or business partners. This personalized nature makes spear phishing much more challenging to detect, posing a significant risk to anyone who handles sensitive information. In this post, we’ll explore how spear phishing works, the related threat of Business Email Compromise (BEC) and practical steps you can take to protect yourself and your organization from these increasingly targeted email-based attacks.

Spear Phishing

Phishing emails are the most prevalent type of email scam. These messages impersonate legitimate entities to trick recipients into revealing sensitive information, clicking malicious links or downloading harmful attachments. Spear phishing is a more targeted form of phishing. Attackers research their victims and craft personalized messages that appear to come from trusted sources, such as colleagues, managers or business partners. These attacks are harder to detect because they contain specific details about the recipient.
Defense:

• If an email seems out of the ordinary or the tone is different from what you’d expect, reach out to the sender through your company’s messaging software or in-person to verify the request.
• As a best practice, get into the habit of making requests for sensitive information over calls instead of email so illegitimate email requests stand out as unusual.

Business Email Compromise (BEC)

BEC scams involve compromising a legitimate business email account, often through phishing or credential theft. Once they have stolen a users login (e.g. through a phishing link) attackers then use that account to request wire transfers, sensitive data or other actions from employees who believe the request is coming from a trusted source. Just because an email is coming from a team member’s real email address does not mean the email is safe. While BEC is unusual, it is important to be wary of requests for sensitive information over email.
Defense:

• Watch out for fake login pages linked from email. These are some of the most dangerous links for company security.
• Don’t send money or sensitive information without verifying the request through known and trusted communication channels like a video call or in person.

Conclusion

As cyber threats continue to evolve, understanding and recognizing the dangers of spear phishing and BEC are critical in safeguarding your organization. These email scams exploit trust and familiarity, making them particularly deceptive and harmful. By staying vigilant, verifying unexpected or unusual requests through secure channels like in-person conversations or calls and maintaining a healthy skepticism of email communications, you can significantly reduce the risk of falling victim to these schemes. Thanks for continuing to learn with us!