The scams that phishers use to fool individuals into handing over their sensitive information have increased in complexity in recent years. In response, many organizations have been set up, both by governmental organizations and private individuals, to mitigate the risk of a successful attack and to help those who have fallen victim to scammers. 

These organizations understand that education is key. By arming individuals with knowledge as to what the most recent scams look like, organizations can reduce the risk of them falling for an attack.

These organizations use various online platforms such as social media to inform the public about the latest phishing scams. This approach can prove to be very useful; knowledge of the Google Docs phishing attack in 2017 quickly spread on social media, which helped in it being shut down relatively shortly after it started.

Spotting Phishing Emails

As well as alerting the public to the latest scams, these organizations offer educational resources for individuals to spot the generic signs of a fraudulent email. Many people know the signs of basic phishing emails; they are poorly written, ask for personal information very directly and contain no visible indicators that they are from a legitimate company. However, due to the sophisticated nature of modern phishing campaigns, this basic knowledge is no longer enough.

Phishers rely on their emails being difficult to distinguish from well-known companies, so they have begun to include logos, signature graphics, and background data collected from internet searches of their victim to fool them into thinking the real corporation is contacting them.

According to several anti-phishing authorities, nearly all legitimate emails companies address their customers by name or by username. Therefore, a common way to spot phishing emails is if a generic opening is used, such as “Dear PayPal customer”. Furthermore, legitimate emails are sent from the company’s real email address, such as @paypal.com. Fake emails may be sent from a similar email address, such as paypal@gmail.com. Carefully checking the sender’s email address can help discern fake emails from real emails.

Spotting Fake Websites

Even if a user follows the link embedded in a fake email, it is not too late to prevent themselves from handing over their information. Users should always closely inspect the website to which they are directed before inputting any information.

Fraudulent websites closely resemble that of the organization being spoofed. Hackers often use subdomains or misspelled URLs are common tricks to create these websites. Some phishing scams use JavaScript to place a picture of a legitimate URL over a browser’s address bar, making the scam even more challenging to notice. Furthermore, the URL that appears when the user hovers over an embedded link may also be disguised using JavaScript.

Users are advised not to follow links in the email, but instead open a new tab and search for the website independently. By logging in through this route, the user can see if there is anything wrong with their account, as they are alerted on login.

Technological Solutions

Users can install gateway filters such that mass-targeted phishing emails are blocked and the number of scam emails reaching a user's inbox is reduced. In the event of an email making it through these filters, installing a web security gateway can prevent users from reaching the target of the malicious link should it be clicked on. These web security gateways work by checking the URL of the destination site against an expanding database of sites suspected of distributing malware.

Response of Organisations

Internet service providers (ISPs) have also deployed anti-phishing techniques. Gmail has “report scam” and “report phishing” options on the drop-down options list when the email is opened.

Similarly, Outlook’s email service has a “report phishing” button on its page. If the scam email came from a Yahoo! account, then it must be forwarded on to abuse@yahoo.com for further investigation. The ISP has the power to close the account from which the email was sent, thus locking the phisher out of their operation.

Some organizations which are commonly spoofed by scammers, such as PayPal or Google, have also taken steps to help protect their customers against malevolent scammers. They may have action plans ready in anticipation of the event that scammers spoof them. Once informed of a scam, they can alert customers or client list about the scam. The company may put notices on their website, social media pages, or even tell local news outlets to raise awareness and prevent their customers from falling victim to fraud.