5 ways to avoid getting caught in phishing scams

Many of the notable cyberattacks of recent years had one thing in common: They exploited information gained in a phishing scam.

Whether it was the cyberattacks on Google, the theft of secure token information from RSA Security or the hack of Oak Ridge National Laboratory, the attackers got their feet in the door by fooling users into clicking a link in an e-mail message. After that, the users might have entered key information on a bogus form or unknowingly downloaded malware that turned over control of their computers.

Malware mavens keep doing it for a simple reason — it works. Sending e-mail is cheap, and getting just one employee to fall for their phishing tactic can take care of the hard part of a hack: getting inside. And it seems there is always someone who will fall for the trick.

But that someone doesn’t have to be you. There are ways to avoid, or at least seriously reduce the chances of, getting caught in a phishing net.

Organizations such as the Anti-Phishing Working Group and Phishing.org offer sound advice for protecting your systems and information, along with updates on current scams. APWG, for instance, reports that a new round of phishing e-mails claim to be from US-CERT, based on information from APWG, and contain an infected .zip file.)

The advice includes keeping browsers and antivirus software up to date, using a firewall, and installing an anti-phishing toolbar that matches a link you are clicking against known phishing sites. The newer version of Internet Explorer 7 and Firefox 2 have such as toolbar, APWG says. And EarthLink offers its ScamBlocker for free.

But software protections, while valuable, are only part of the equation. The biggest weapon spammers have is social engineering — exploiting the human element.

And that’s where users can update and strengthen their personal defenses. Here are five tips.

1. Question authority.

At one time, spam e-mails seemed to feature mostly lurid subject lines promising compromising pictures of a celebrity or promises of free prizes. Those tactics are still in use, but spammers have found that seemingly authoritative e-mails work just as well, if not better. Messages that appear to come from a human resources department or a government entity have been used in recent scams. They often sound urgent and/or scary and stress the supposed importance of entering your information right now.

It’s worth remembering that the IRS, law enforcement and other agencies don’t send you e-mails for official purposes. And be careful about any message asking you to enter your credentials and updated information on a personal account. You might want to call first to be sure the message is legitimate; that’s a pain, maybe, but it’s good protection.

2. Be cool on hot topics.

If an individual, event or topic is trending on the Web, spammers will often try to take advantage. When tennis star Serena Williams yelled threats at a line judge during a match, spammers promised the video — but misdirected the link. After Osama bin Laden was killed, e-mails offering the unreleased photos of his body abounded.

So it’s wise be wary about electronic communication around big events, especially if it’s from an unknown source. The Super Bowl is coming up, and this year also features a presidential election and a summer Olympiad. All are potentially fertile ground for spammers. If an e-mail, text or posting promises a link to familiar site (say, a story in the Los Angeles Times), and if you’re not certain of who is sending it, you could try going that site to look for the item. Or type in the URL manually, in case the link you’re clicking has been spoofed.

3. Don’t get too personal.

It’s a good idea to be careful about what you post to Facebook and other social media platforms for a variety of reasons, from avoiding embarrassment to keeping your job. But social media also is a source of information for highly targeted spear phishing attacks, which typically target executives or other people with access to sensitive information.

Attackers can troll social media sites looking for information about where people work, their habits and hobbies, friends and families and then incorporate some of that information into crafting a phishing pitch. Of course, the idea behind Facebook or LinkedIn is to interact with people, so you don’t want to be taciturn, but it’s not a bad idea to keep some things, particularly concerning work, close to the vest.

4. Watch where you’re going.

In addition to being suspicious about filling out any financial information online, check to see if an e-mail message has been digitally signed, which can ensure it wasn’t spoofed, APWG advises. Sometimes an illegitimate site might simply add a word to its URL, such as “/paypal,” to try to fool visitors. Simply eyeballing the address can sometimes save you a lot of trouble.

Also, if you follow a link to a site asking for information, try to make sure it’s secure, displaying the “https” in the URL indicating a Secure Sockets Layer connection and a yellow lock at the bottom of the page. But be warned: APWG points out that phishers can now spoof https URLs and the yellow lock, making it appear that you’re on a legitimate site. As with following other links, the group recommends entering the website address yourself rather than clicking on a link.

5. Follow the game.

Like it or not, phishing and other forms of cyberattacks will be with us for as long as there is an Internet. And if you use the Internet for work and/or personal reasons, it’s a good idea to stay apprised of the dangers, just you’d want to know about icy road conditions or health risks discovered in your favorite food. Phishing.org recommends keeping an ear out for news of phishing scams and being aware of the latest techniques. Checking sites like APWG and Phishing.org once in a while wouldn’t hurt.