Have you ever gotten an email from someone claiming to be royalty? In their email, they tell you that they will inherit millions of dollars, but need your money and bank details to get access to that inheritance. You know this email isn’t legitimate, so you delete it, yet there are many more scams being perpetrated by criminals that sound more believable and aren’t as easy to spot. Learning to identify and avoid these scams is the first step in protecting yourself from these schemes.
Senior Kenyan Citizens are often particularly vulnerable to some of these fraud campaigns. The world today is full of cybercriminals launching both phishing emails, and the tried and true phone scams that never fell out of fashion. Protecting not only your finances but also your data from these scams is more important now than ever.
What is Phishing?
Phishing is an online scam involving emails that appear to be from a trusted source. Recent examples try to convince recipients that they are exceeding their email quota and need to upgrade their account by clicking a link. Others have said that the recipient’s account is going to be deleted unless they click the link to renew it. These are all SCAMS
Phishing emails are convincing and trick many people into providing personal data. These emails tend to be written versions of the scam phone calls.
Some signs of phishing emails are:
- Imploring you to act immediately, offering something that sounds too good to be true, or asking for personal or financial information
- Emails appearing to be from executive leadership you work with requesting information about you or colleagues that they usually do not request.
- Unexpected emails appearing to be from people, organizations, or companies you trust that will ask you to click on a link and then disclose personal information. Always hover your mouse over the link to see if it will direct you to a legitimate website
- Typos, vague and general wording, and nonspecific greetings like “Dear customer”
Signs of Phishing Emails
When you receive an email with links or prompts for information, make sure to stop and think about the links before clicking or responding.
Here are some tips to help you identify the signs of a phishing email.
Who is the email from?
Always check the email sender.
Phishing messages attempt to convince you that the message is from a trusted source. This is typically done by using a fake signature or email display name that will lead you to believe the message is from someone else, such as the Help Desk, Microsoft, an Email Admin team or something similar.
Always check the sender of an email message by looking at the actual email address that sent the message, even if the email display name is a recognized name.
Does the email ask for or promise money?
Never provide your financial information or make payments through unsecured systems. Do not spend money on behalf of others.
If something sounds too good to be true and it’s coming from somebody you don’t know, it’s almost certainly a scam. Even if the message is from someone familiar, the name and email address may be impersonating the individual, to make it appear it is from them, although it is not. Always check the actual email sender or ask for verification.
Financial scams are often advertised as easy jobs that offer a profit for purchasing items or reimbursement or an acquaintance who is in a hurry. There is no legitimate reason for you to handle payments or financial transactions for somebody else. If you are asked to purchase gift cards, services, do a wire transfer, deposit money, forward money, or perform any financial transaction you are likely involved in a scam.
Where does the link go?
Always check the link.
Another tip to improve online safety is to always check the destination of a link before clicking it. This can typically be done by hovering over a link before clicking. Does the web address make sense? For example, when you visit LearnersCoach, learnerscoach.co.ke is in the web address.
What's the email about?
Always be suspicious of emails regarding account status that include links to log in, such as mailbox quota limits, account deactivation, etc.
The most frequently used subject in a phishing message typically pertains to the status of your email account, leading you to believe that there is some sort of action requiring you to log in. Examples include reaching a mailbox storage quota limit, impending account deactivation, or that incoming messages have been placed on hold until you log in.
Does the email contain typos and poor grammar?
Check the content of the message for misspelled words, poor grammar or odd punctuation.
Phishing messages will often include spelling errors or odd punctuation due to translation errors or due to an attempt to bypass standard email spam filters. Remember, these messages are crafted to trick you into divulging your credentials. With that said, do not trust an email message simply because the spelling and formatting are correct, this should be used with all other tips to determine the legitimacy of a message.
Does the email have suspicious attachments?
Don’t open any attachments that you were not expecting.
If you receive an unsolicited email containing a suspicious attachment from a sender that you do not recognize, do not open the attachment. If the email claims to be from your department, such as Payroll or the Help Desk, we recommend reaching out to that department directly to confirm the legitimacy of the attachment.
What to do if your online account is compromised?
If you fall victim to a phishing attack, you should take the following steps to ensure that your online (account) is secure.
Change your password
If your account is still accessible, change your password as soon as possible. The longer someone has your credentials, the more harm they can cause.
Flag the message as phishing
If you still have the phishing message, select the message within your inbox, select the dropdown next to “Junk” and then select “Phishing”.
Check your signatures
In an attempt to phish additional victims, attackers may add links to your email signature.
Check your forwarding rules
Some attackers may set your account to automatically forward all email to an account they control. Check to make sure that your emails are not being forwarded to another address.
Check your inbox and sweep rules
Attackers may add filters to hide their activity from the account owner. Check to make sure that no new inbox rules have been created.
Identity Theft
If you provided any personal information when responding to a phishing message, you may be at risk of identity theft. Please visit your ICT security Awareness department for more information on recovering from identity theft.
Check your Payment and Account Information
Log in to your bank account using your online username and password and select the Payment and Account Information channel to check for any changes that may have been made or suspicious activity. If you notice any suspicious activity or have issues with a refund contact your bank branch manager for further action.
Check if any other accounts have been compromised
Enter your work email or any other personal email address you would like to test on Have I Been Pwned to see if any of your third party accounts have been compromised in a data breach.
Conclusion
Beware that many scams and phishing emails look legitimate! An email pretending to be a company might contain pictures or text mimicking the company’s real emails. If you’re unsure about an email you received, there are some steps you can take to protect yourself:
- Do not click links or open attachments in emails you were not expecting
- Do not enter any personal, login, or financial information when prompted by an unsolicited email
- Do not respond to or forward emails you suspect to be a scam .If in doubt, contact the person or organization the email claims to have been sent by using contact information you find for yourself on their official website
- What happens if I compromised my computer? If the scam introduces malware to your computer, it is a lengthy process to clean the computer and restore it to pre-link clicking. That also may involve removal of your computer from the network, until it has been cleaned, as compromised computers may infect other computers on the network.
- What should I do if I receive a possible phishing scam email? Even though the email may appear to be from your work department, or your bank, or credit card holder or other trusted source, without clicking the link, hover your mouse pointer over it. The URL will display and you may see where it actually wants to take you. If the actual URL does not match the text of the link in the email do not click it. Most likely no organization will ask you to to provide personal information via email.
- What if I think I did click a scammer’s link? If you did click a link on a phishing scam, immediately go to your account login page and use the change your password link to set a new password
