How to Avoid Falling for Spearphishing Tactics
Many of us are familiar with phishing attacks. These broad-based emails typically come across as spam. They are sent out by the millions every day, promoting get-rich schemes or promising to send you money if only you share your banking info.
Spearphishing is much more targeted and personalized toward individual recipients. A scammer will scrape information from publicly available sources and tailor a message designed to build trust. Spearphishing emails typically seek to 1) gain login credentials; 2) plant malware on a target’s computer by encouraging the recipient to click on a malicious link or download a virus; or 3) convince the target to send the scammer money via a faked invoice or other means. Variants of the attack include using text or voicemail to fool the target.
Indicators of a Spearphishing Email
Since the scammer seeks to elicit trust in the victim, emails typically include the person’s name. Sometimes they are personalized down to departmental detail and other nuggets easily found on the web. In extreme cases, the scammer may scrape social media for even more personal info and work it into the message to create the illusion of actually having met with the target personally. Spelling errors and odd phrasing might indicate a non-English speaker wrote the email, suggesting an overseas scammer.
Be on the lookout for these common characteristics of a spearphishing email:
