Editorial · October 22, 2018
Phishing Emails: How Your Staff Can Spot Them Early
Phishing emails are fake messages that try to trick you into handing over a password, a bank number or control of your computer. They are one of the most common ways thieves get into a small business. This guide lists the red flags your staff can learn in ten minutes, and a short routine for what to do next.
What phishing emails try to do
The Federal Trade Commission describes phishing as a scammer using fake emails or texts, or copycat websites, to get you to share personal information. That can mean account numbers, Social Security numbers, or your login names and passwords. The scammer then uses the data to steal money or an identity, or both.
There is a second goal that matters to a business. The FTC notes that scammers also use phishing emails to get into a computer or network. From there they can install programs such as ransomware, which locks you out of your own files. One careless click by one employee can reach the whole office.
October 2018 is a good time to talk about this with your team. It is the 15th year of National Cybersecurity Awareness Month, led by the Department of Homeland Security together with the National Cyber Security Alliance. The theme this year is that cybersecurity is a shared responsibility. In a small company, that means every person who opens the inbox.
Five red flags to teach your staff
No single sign proves a message is fake. Two or three together should make anyone stop and think.
- Pressure and fear. The FTC says phishers make it seem that you must act fast or something bad will happen. The message may say an account will be frozen, a tax refund will be lost, or even that your boss will be angry.
- A familiar name on an unfamiliar request. Scammers copy the logos of trusted companies. Some pretend to be a friend, a family member or a manager.
- A request for private details. A real company does not need you to send a password or a financial number by reply.
- A link that hides its real address. A link or phone number may look right, yet the true destination can be hidden.
- An attachment you did not expect. Files and links can carry malware that weakens your computer's security.
Remind staff that even a friend's or coworker's account can be hacked. A message from a known name is not proof that it is safe.
What to do when a message feels wrong
Keep the first step simple: do not click and do not reply. The FTC advice is to do your own typing. If a company sends you a link or phone number, do not use it. Look up the website or number yourself with a search engine, or use the one in your address book.
If you think a person or company really does need something from you, pick up the phone and call them. Use the number you already trust, not the one in the email. A thirty second call costs far less than a stolen login.
Post these steps near the front desk or in the staff chat. People follow a rule they can remember. "Do not click, look it up, call" is easy to remember.
Set up your defenses before the next email arrives
Training helps, but some steps work even when someone slips. The FTC lists three that any small team can do this week.
- Turn on two-factor authentication. For accounts that offer it, you need your password and a second item, such as a code sent to a phone. That protects the account even if the password leaks.
- Back up your files. Copy them often to an external hard drive or cloud storage. A recent backup is your best answer to a virus or a ransomware attack.
- Keep security software current. Use software you trust, and set it to update on its own.
A short reporting routine for small teams
Reporting only works if staff know where to send things. Pick one person, and one inbox or chat channel, as the place where suspicious emails go first. Then follow the same steps each time.
- Staff forward the message to the named person and then delete it from their own inbox.
- The named person forwards it to spam@uce.gov and to the company that was imitated. The FTC says a report works best when it includes the full email header, which most email programs hide. Search the name of your email service plus "full email header" to learn how to show it.
- The person can also forward it to reportphishing@apwg.org. The Anti-Phishing Working Group, which includes internet providers, security firms, banks and law enforcement, uses these reports to fight phishing.
- File a report with the FTC at ftc.gov/complaint.
Tell the whole team when a real phishing attempt arrives. Seeing a real example teaches more than any slide.
If someone already clicked
Do not blame the person. Fast action matters more than fault. If an employee gave away a password, change it at once on the real site, and on any other site where it was used. If the message led to a loss of personal data, the FTC points victims to Identitytheft.gov, since phishing victims can become victims of identity theft. Ask your IT support, or whoever looks after your computers, to scan the machine for malware.
Then write down what happened and when. A short note helps you fix the gap, and it becomes the best training story you have.
Sources
- Federal Trade Commission, Consumer Information: Phishing, consumer.ftc.gov/articles/0003-phishing (page dated July 2017).
- Department of Homeland Security, National Cybersecurity Awareness Month, dhs.gov/national-cyber-security-awareness-month.