Dangers of phishing

• Reputational damages
• Financial losses
• Law suits
• Loss of employment as consequence of above.

Identifying a phishing attack

1. The sender’s domain is public e.g. @gmail.com, @yahoo.com. Thus, always look at the e-mail address, not just the sender.
2. The domain name contains spelling errors.
3. The content of the e-mail is littered with spelling and grammatical errors, with grammatical errors the least likely to be a typo.
4. Review the greeting. No professional e-mail will start with “Hi Dear”. And any organisation you work with directly will generally address you by your title and surname. Something bulk phishing e-mails cannot do.
5. The message contains suspicious links. An e-mail from Netflix will link you to an address which starts with “netflix.com”. Sometimes these links are embedded in button. Prior to clicking on it, however your mouse over the button and review the destination address which appears.
6. The message requests that you share personal information. Any message asking to enter or verify personal information or banking details is a major red flag.
7. The message content creates a sense of urgency to counter our tendencies to procrastinate in taking action when something is not exceptionally urgent.
8. The message contains a threat of negative consequence such as loss of money, closure of accounts and legal action to be taken against the user if they do not respond.
9. In general, phishing e-mails revolves around the following topics:
   a. They have noticed suspicious activity on your account
   b. There is a problem with your account or payment information
   c. Request that you confirm your personal information
   d. Contains a fake invoice as attachment
   e. Provides a link to make payment
   f. States that you qualify for a government refund
   g. Provides coupons, other free goods, free vacations or large monetary rewards.

Protection Tips

• Always remember, you as employee is the first line of defence. So think before your click!
• Have caution and be mindful of the websites accessed and files opened on your computers.
• Be constantly aware that you are working with data and information which valuable to cybercriminals.
• Keep your systems and programmes updated.
• On a regular basis scan the internet for exposed e-mail addresses and credentials
• Be vigilant! Any e-mail that raises suspicion must be examined with caution.
• Use multi-factor authentication to protect your accounts.
• If you suspect you’ve clicked on a link or downloaded an infected attachment, update your security software and run a scan.
• Report any suspicious e-mail to your IT department.
• If it appears to be too good to be true, it probably is.
• Install anti-phishing toolbar
• Verify the site’s security. A secure site always starts with “https” and have caution when links appeared to be shortened – place your cursor over it to view the end destination.
• Have caution when it comes to pop-ups.
• Never use public networks.