Ever wonder why Carmen and Ken get way more malware alerts than any other user on your network? Are they loose cannons creating preventable problems for you?

There are a few ways to help get this under control.

It turns out some people are pretty gullible when it comes to email — because after all, why would anyone be sending email that would cause a problem? Certainly not their bank, credit card company, or FedEx.

But hackers are using a type of social engineering called "phishing" to con Carmen and Ken into unwittingly installing malware on their devices, and consequently your network. They do this by closely imitating the kind of legitimate email people are used to getting all the time.

How Phishing Works

Tactics include making it look like email is coming from a trusted source, but upon closer examination the source is completely different than expected. The displayed name is very familiar and trusted, but the actual email address is different.

The email often compels the reader to click on a link or "button." Here again, the displayed link looks trustworthy, but the hyperlink takes you places where you don't want to go.

Since everyone gets and depends on email, getting people like Carmen and Ken who click on things willy-nilly has become the biggest delivery method for malware and targeted attacks. Phishing attempts are becoming increasingly clever and harder to detect.

Teaching your users to be paranoid, vigilant, and aware is an extremely important — and affordable — layer of defense for your network.

5 Tips to Share with Your Users

1. Treat All Email as Suspect, No Matter What

This sounds extremely paranoid — and it is. Though it's hard to get used to, it will save you a lot of pain. The moment your users start assuming every email is legitimate until proven otherwise, they've already lost the game.

2. Be Patient Reading Over Email Before Reacting

Stop. Look. Examine.

If your users are closely examining their email, they (and you) won't be victims. Scan the displayed name AND the actual email address of the sender. Do they match? A message that appears to come from "PayPal Support" but originates from paypa1-support@randomdomain.ru is a dead giveaway — if you look.

3. Check Out Any Links Before Clicking

You can do this by merely hovering your mouse over the link or "button." Does the link that comes up in the little box look like a genuine site from the sender (your bank, credit card company, or FedEx)?

A button that says "Verify Your Account" might link to http://paypa1.com/verify instead of https://www.paypal.com. The difference is subtle — and that's exactly the point.

Never click a link in an email if you're not 100% sure of its destination.

4. Ask Yourself: "Does This Make Sense?"

Most of the time there's something a bit off about a phishing attempt. If you feel confused about why you're getting the email, or the content is in any way unusual — including misspellings, odd formatting, or an unexpected request — make sure you review the steps above.

Legitimate companies rarely ask you to urgently verify your account, confirm a payment you didn't make, or click a link to avoid account suspension. When something feels off, trust that instinct.

5. When in Doubt, Get It Checked Out

If you're still not sure, get it checked out by someone who handles your IT so they can help you figure it out. It's far better to ask a "dumb question" than to click a link that deploys ransomware across your network.

Going Further: Test Your Users

There are excellent methods available to further test your users' susceptibility, including sending them "fake" phishing emails. Implementing this kind of test will help you see which users are the most susceptible and teaches them how to detect these threats before they are unleashed.

OTM can help you set up user awareness training and simulated phishing campaigns. Contact us at 800-292-3537 to learn more.

Do you have any tips or unusual phishing stories to share? We'd love to hear them.