Forms of phishing

Phishing comes in many forms, from mass emails to targeted attacks against business leaders, for example. Sometimes cybercriminals shoot with hail, attacking random people. But that is not always the case: “spear phishing” is also increasing, with cybercriminals acting in a very targeted and personalized way. Hackers choose specific targets and then conduct research to create and send customized, personalized emails. For example, it may appear that the email comes from a reliable source, such as a colleague or manager, but it may subsequently turn out to be a phishing email after all. Other forms include SMS phishing (smishing) and phone phishing (vishing), where criminals try to trick you via text or phone calls.

How do you recognize phishing?

Recognizing phishing is crucial to protect yourself. Note the following signs:
‍

• Unexpected or strange messages:

If you receive a message you're not expecting, be extra careful. Sometimes messages are also strange, such as a supplier suddenly asking for payment to a different account number.
‍

• Vague title:

Phishing emails often start with generic pronouns like “Dear Customer” instead of your name.
‍

• Unusual URLs:

Check link addresses by hovering over them without clicking. They often differ slightly from the real URLs. Are you not sure? Then use the tool checkjelinkje.nl.
‍

• Urgent language:

Panic messages use terms like “Immediate action” or “Your account will be closed.”
‍

• Unknown sender:

It is possible that the sender uses an unusual email address or that the sender is unknown at all.
‍

• Grammar and spelling errors:

Many phishing emails contain obvious grammar and spelling errors. However, with the rise of AI, emails are becoming increasingly professional and difficult to distinguish from legitimate mail.

• Style deviations:

For example, the email may contain a discolored color, writing style or logo. Here's also the case: with the rise of AI, emails seem increasingly professional.

The dangers of phishing

Phishing can have serious consequences, both for individuals and companies. First, it can lead to direct financial damage, such as robbing bank accounts or making fraudulent purchases. In addition, identity theft is a major risk, with criminals using personal information for fraudulent activities. For companies, reputational damage is a major concern; they can lose the trust of customers and partners. Finally, phishing can lead to data loss, where sensitive business information falls into the wrong hands, which can result in loss of competitive advantage or legal problems.

How can you protect yourself?

Fortunately, there are several ways to protect yourself and your organization against phishing:

‍

• Be alert to suspicious messages: Always check the sender and look for irregularities in the email.
• Use two-factor authentication: Add an extra layer of security to make it difficult to access your accounts.
• Invest in security awareness: Make employees aware of the dangers of phishing and teach them to recognize and report suspicious messages.
• Phishing simulations: Run regular phishing simulations to test your organization and train employees.

What do we do with phishing during the ISO 27001 implementation?

Phishing is a serious threat to any organization, which is why it is essential to pay attention to this when implementation of ISO 27001. During our risk analysis, we always look at the dangers of phishing and take specific measures to combat this. This includes raising awareness among you and your colleagues about the risks of malware. We help you to be alert to suspicious emails and links so you don't fall into the trap.

‍

In addition, in consultation with your IT department, we use technical means such as SPF, DKIM and DMARC to ensure the security of your e-mail traffic. These tools help verify that an email really comes from the sender it claims to be. In this way, we reduce the chance of malicious e-mails coming to you.

‍

It is also important that you know how to report phishing. That's why we develop efficient reporting channels so that you can report suspicious emails quickly and easily. This is how we keep your organization safe together and ensure that your cyber risks remain well manageable.

We can help you with so much more!

We offer various phishing simulations to arm your organization against this threat that continues to evolve. We'd love to help you create a safer digital environment. Want to know more about how we can help you? Then feel free to contact us. Together, we will make sure that phishing has no chance!

‍