Best Practices for Phishing Emails

Phishing attacks are a sneaky form of social engineering that can lead to severe data breaches. In a phishing email, a cybercriminal poses as a trusted contact in an attempt to gain access to sensitive data.

Phishing attacks are very pervasive, with over 3 million phishing emails sent every day. Phishing attempts have also gotten more sophisticated over the past few years. Hackers are now using AI technology to create more effective phishing emails.

To prevent these malicious email attacks at your organization, you need a strong cybersecurity strategy in place. Here are email security best practices to help your team avoid falling prey to phishing threats.

Key Takeaways

• Advanced technology has made it easier for hackers to send phishing messages in large volumes.
• Organizations should educate their employees on the dangers of phishing to prevent data breaches.
• The biggest indication of a phishing scam is an error in the sender’s email address.
• Avoid clicking on links or opening attachments in a suspected phishing email.
• When reporting a phishing email to someone else, never forward it.

The New Era of Phishing Scams

In the past, phishing messages were usually fairly easy to spot. They were often characterized by poor spelling and grammar and were riddled with factual errors.

However, AI technology has made it easier for cybercriminals to create more convincing scams. ChatGPT and other LLM tools can create messages without the telltale spelling and grammar errors, making them much harder to spot.

For example, here’s a phishing email that GPT-4 came up with:

When compared to phishing emails of the past, this one is eerily convincing. Not only could this email potentially fool your team members, but it could also get past email spam filters.

In the past, these email filtering features have been very effective at identifying phishing scams before they make it to your inbox. Now, they might not be enough to prevent costly phishing attacks.

Additionally, hackers are using AI technology to generate phishing emails much more quickly, leading to a higher volume of attacks. 

Between Q4 2022 and Q4 2023, there was a 1,265% increase in phishing attacks, likely due to the newfound accessibility of AI chatbots.

As the signs of phishing become harder to spot, organizations will need to implement more advanced phishing prevention strategies. 

Failing to address these vulnerabilities could lead to serious data breaches and damage to your brand’s reputation.

Best Practices for Identifying and Reporting Phishing Emails

Since phishing messages have become more sophisticated, your entire team will need to be very cautious when opening emails. Consider holding a security awareness training to cover these important topics and get everyone on the same page.

Here are some best practices to help you identify dangerous phishing emails.

Check (and Double-Check) for Inconsistencies in Sender’s Email Address

The first thing to check when looking for phishing emails is the sender’s email address. 

When hackers launch a phishing attack, they pose as a trusted contact. However, they usually won’t have access to that contact’s email accounts, so they’ll create an email address that looks similar.

Before you open an email, double-check to make sure the email address listed is accurate. In many cases, it will look like a legitimate business email at first glance, but the domain name will be slightly off.

For example, the hacker might use name@parachtuetechs.com instead of name@parachutetechs.com. They might also change the type of domain—for example, changing .com to .net.

Check the Sender’s Address and Display Name to Ensure They’re Aligned

One way that hackers hide the inconsistencies in their email addresses is by changing their display name to reflect the person they are impersonating.

For example, many cybercriminals will pose as major tech organizations like Amazon or Google in their phishing attacks. 

They will use an email address that is obviously incorrect, such as name@amzon.com, but hide it with a display name like “Amazon Customer Service”. 

Since the display name looks legitimate, many people won’t notice that the email address is wrong.

Depending on which email client you’re using, you might only see display names when opening your inbox. 

To avoid being scammed by phishing emails, double-check the email address of every message you receive, even if the display name looks legitimate.

Be Wary of Emails Insisting on Urgent Action

Phishing messages often rely on urgent language to trick recipients into acting before they have a chance to think. For example, they might use subject lines like “Verification Required Immediately” or “Overdue Invoice”.

Hackers use these urgent phrases to create a sense of panic in their victims. It’s easy to see how even the most discerning recipients could be fooled by this type of language.

You should always be wary of emails and text messages that have an urgent tone. Even in an emergency, most legitimate organizations won’t use this type of messaging to get your attention.

If you receive a message like this, take a deep breath and assess the situation carefully. In many cases, it will be clear once you read the message that it is a scam. In many cases, these emails ask for payment for an item you didn’t purchase, or require verification for a service you didn’t sign up for.

Be Cautious of Attachments

Many phishing emails have attachments containing ransomware or other forms of malware. These are dangerous software programs that can capture sensitive data from your computer.

Luckily, many email clients now have features that prevent attachments from opening or downloading automatically. However, you should still manually check each attachment before opening it to make sure it’s safe to use.

In general, it’s best to avoid opening email attachments unless you are 100% sure they are from a trusted sender. You can also use antivirus software to scan email attachments before you open them. 

Antivirus programs can identify signs of malware and other threats that may be present in the attachment.

If It Involves Passwords or a Money Transfer, Get a Second Opinion

Most phishing emails have one of two goals: gaining access to valuable login credentials or stealing money. 

Some phishing campaigns will even do both. For example, they might gain access to your bank login information to take control of your finances.

Always be cautious if you receive an email that asks you to confirm your password or make any kind of bank transfer. Even if it appears to come from a trusted source, it could be a very well-disguised phishing email.

Instead of responding to the email right away, get a second opinion from someone else in your organization—ideally, someone with IT or cybersecurity expertise.

Don’t Ever Send Sensitive Information Over Email

If you need to send your credit card details, social security number, bank account number, or other sensitive information to someone else, don’t do it over email. 

There’s always the risk that you could be targeted in a sophisticated phishing scam. It’s also possible that cybercriminals could intercept your email and access this secure information.

If you need to send sensitive information to someone else, look for an alternative way to communicate. 

For example, if you need to give your social security number to an employer for tax purposes, confirm it over the phone or use a secure online form.

Check Links By Hovering Over Hyperlink

You should also look out for suspicious links when opening your emails. Clicking links in a phishing message could take you to malicious websites to steal your valuable data.

Links in phishing emails often look like links to legitimate websites that you visit frequently, such as your bank’s homepage or the homepage of a popular retailer. 

However, when you hover over the hyperlink, you’ll be able to see the URL that the link will actually take you to.

Always check to make sure the URL is legitimate and matches the link description. Keep an eye out for small spelling and formatting errors, just like you would when reviewing email addresses. 

Err on the side of caution—if you have any doubts about the link, don’t click on them.

Report All Suspicious Emails to Your Manager or IT Security Team

Don’t ignore suspicious emails at work. If you’re frequently receiving them, it’s likely a sign that your workplace is being targeted by hackers. 

Be sure to report phishing emails to your supervisor or IT security team so they can address the problem on a larger scale.

Don’t Forward the Email!

When reporting a suspicious email to your IT team, avoid forwarding the email to them. 

If you forward the email to someone else, they could accidentally click on a malicious link or open a suspicious attachment. 

Instead, describe the email to them, take a screenshot, or show the email to them in person if possible.

Report the Email

Both Google and Microsoft Outlook have reporting features to help identify scammers and prevent future phishing attacks. 

If you get a suspicious email, report it to your email client to prevent them from sending more attacks in the future.