The growing threat of email phishing scams and how to protect your business

Phishing was first described in 1987. Since then, it’s evolved as cybercriminals find new ways and new technologies to exploit vulnerabilities and steal private information through emails, text messages, advertisements, fake websites, and other means.

Since the majority of phishing scams are delivered by email, we’re sharing five of the most pervasive email phishing scams below:

1. Standard Email Phishing Scams: This most well-known scam is an attempt to steal sensitive information via emails that seem to come from a legitimate organization. They are usually sent out far and wide, without necessarily targeting an individual.
2. Malware Phishing Scams: These scams use the same techniques as a standard email phishing scam, encouraging users to click a link or download an attachment to unknowingly install malware.
3. Spear Phishing Scams: While standard phishing scams cast a wide net, spear phishing scams tend to be well-researched and are highly targeted at business executives, public figures, celebrities, and other lucrative targets.
4. Clone Phishing Scams: In a clone phishing attack, cybercriminals compromise a person’s email account and make changes to an existing email, such as swapping a legitimate link or attachment with a malicious one, before sending it to the person’s contacts.
5. BEC (Business Email Compromise): This type of phishing attack involves a phony email being sent from someone who appears to be in, or associated with, a trusted organization, and often, requesting urgent action. This type of email phishing scam was reported to have caused nearly half of all cybercrime-related business losses in 2019.

No matter how informed you are, as technology and cybercrime tactics evolve – such as through the use of AI tools like ChatGPT – email phishing scams become increasingly clever and difficult to identify. Here are some tips to spot an email phishing scam:

1. Demands for urgent action. Emails tend to demand immediate action with the threat of negative consequence or loss of opportunity. This aims to rush the recipient into action before realizing the email’s flaws or inconsistencies.
2. Bad grammar and spelling. The odd typo aside, phishing scam emails are often riddled with bad grammar and spelling mistakes.
3. An unfamiliar greeting. Emails sent in phishing scams begin with an unfamiliar salutation or title that’s not normally used in business communication or conversations with colleagues.
4. Email addresses, links, and domain name inconsistencies. If a suspicious email appears to come from an organization you know, make sure the email address matches previous emails from the same organization. You can also check if a link in an email is legitimate by hovering the mouse pointer over it.
5. Suspicious attachments. Workplace file sharing tends to take place using trusted collaborations tools. Emails with attachments should always be treated with suspicion, particularly if they have an unfamiliar extension, or one commonly associated with malware, such as .zip, .eve, .scr, among others.