How to avoid a Phishing email scam

Sadly, email-based scams don’t appear to be going away, if anything, they’re on the increase. Known as Phishing, they range from trying to trick you into handing over login details for things like your email services or Internet banking to making you believe you’ve had an email from the owner of the business where you work, to make an urgent payment.

They’re designed to try and catch you off guard, and they always seem to arrive when you’re busy with something else, so you don’t have your spider senses optimised to detect that it doesn’t seem right.

The people and bots that are sending out these emails are playing a numbers game. They will send thousands of them out, and if they can trick just one or two people, it could mean a substantial payment is made to them, or they obtain details to create unknown havoc to your work and personal life.

What to look out for: Strange links/asking you to click or download

If you get an email, even from what appears to be from someone you know, asking you to click the links in the email, download something or open a strange attachment, then alarm bells should be ringing. The best thing you can do, even if you think it might be legitimate, is not interact with the email. Simply delete it, and give the person who sent it to you a call to see if it was them. If it’s from someone you don’t know, then you really should delete it and think no more about it. Most of the time, the links and downloads are a scam, to try and run software on your computer to capture valuable details.

What to look out for: Asking for a payment to be made to a new bank account

A common scam is to receive an email posing as the owner of the business, or someone from the finance department, asking you for an urgent payment to be made to a new bank account, perhaps with no explanation as to what it is for. This is where you must have a manual process, to do checks before you even consider making the payment. You should have something in place, where verbal approval is needed from the person asking for the payment to be made, along with secondary approval from someone else who gives you a second opinion. You really must stop what you’re doing, take a step back and ask yourself if this request is legitimate. Just taking time out and thinking about it, will normally allow you to reach the right conclusion. Never rush, never hurry things – that’s when you get tricked.

What to look out for: What is the email address used to send the email?

Whilst you may get an email, where the name of the sender appears to be genuine, it does not mean the actual email address for that person was used (although advanced scammers can spoof an email address). If you feel something is wrong, take a look at the email address of the sender in the top part of the email – you can normally see it, or click on the person’s name to then see the address. If, for example, the usual address for that person is joe@businessname.co.uk but having done your checks, it was sent from jb839@gmail.com then you can pretty much guarantee that it’s not a legitimate email, and it should be deleted and not interacted with. 

In short, the theme and message we’re trying to convey here is, if in doubt, delete the email and do nothing. Interacting with the email or taking the steps requested in the email is the worst thing you could do.

What else can you do to help reduce the chances of a Phishing scam?

• Use MFA/2FA authentication on all systems which offer this second layer of protection
• Use a spam/scam email filtering service, which checks your emails before they are delivered to your Inbox
• Ensure you’re not using an administrator account on your computer, for your everyday tasks

If you wish to discuss protecting your business in more detail call us on 01527 908646 or email hello@lucidcomputersolutions.co.uk

Gavin Moorhouse is the owner of Lucid Computer Solutions, which is based in Redditch and provides IT Support and Business Solutions. He deletes most emails he receives.