Fraud Through Email

One of the best methods to communicate with anyone is via email. However, it is also one of the main tools used by attackers to obtain money, login information, and private data. 

Introduction:

Users may communicate with the email scammer and give important information, which could result in identity theft, financial loss, and data corruption for your company.

Attackers use a variety of typical tactics. You probably get spam emails in your inbox if you use your email address on contact forms all over the internet and have a free email service like Gmail.

Attackers may try to catch a lot of people by sending out a lot of fake emails. This idea says that the more emails are sent, the more likely it is that a large number of targeted users will be tricked.

Other attackers might adopt a more deliberate strategy, picking a victim with the appropriate access to information, systems, or resources. The assailant conducts online research on the victim before personalizing and convincingly crafting emails for them. Sometimes, an attacker has already gained access to a valid email account and has access to past email exchanges, calendars, and contacts.

Email scams can take many different forms, including:

• Pharming
• Identity fraud
• Ransomware
• Financial fraud
• Online fraud
• Supply-chain intrusions

In order to fool a specific user into giving confidential information, an attacker sent the message in the image above (which was delivered to Gmail’s spam folder). Attackers employ this kind of statement since FedEx cargo is always on hold. Thousands of recipients could be duped by the message if it is sent to them.

Scams frequently use email spoofing:

Scams frequently use email spoofing, although the sender’s email address in the aforementioned image comes from a public domain and is not connected to FedEx. Although the email has just one link leading to a malicious website, it does not provide a contact number.

The fact that the email does not include the recipient’s name or contain other personal information that an accounting vendor would include is another indication that it is a scam email. Only the recipient’s email address is included in the generic salutation of the email (the email address is blacked out).

The most typical method used by scammers to target potential victims is by sending phoney emails that appear to be from a genuine business. They will persuade you to click a link and input your financial and personal information into a false website that mimics a real website.

The emails usually prompt you to “verify,” “update,” or “reactivate” your account with a sense of urgency. It might be a sign that something isn’t right and that, if you don’t take action right away, bad things will happen, like you’ll lose money or there will be fraud on your account. The scammers don’t want you to have time to check the email’s legitimacy or do any research.

Occasionally, the email will make financial promises, requesting your information in the event of a refund, credit, surprise lottery win, or employment opportunity.

When a link or attachment is clicked, harmful software (malware) is downloaded into your computer or another device in certain fake emails. Because certain viruses may monitor your online activities, it can record and transmit to the fraudster your financial, personal, or security information.

Types of phishing attacks:

Attacks including phishing have existed since the early days of the internet. Midway through the 1990s, cybercriminals used the America Online (AOL) service to spread the first phishing attempts in order to steal credit card numbers and passwords. Cybercriminals employ more sophisticated strategies, even though contemporary attacks employ comparable social engineering concepts. At its essence, phishing is an attack strategy that uses social engineering techniques to persuade someone to act against their better judgment. Organizations can better safeguard their users and data if they have a better awareness of the 14 different kinds of phishing attacks and how to spot them.

1. Phishing in emails

One of the most well-known attack methods is email phishing, also referred to as “deception phishing.” Malicious actors send emails to users posing as well-known firms in order to deceive users into clicking on a link or downloading an item.They then employ social engineering techniques to make the communication seem more urgent.

Usually, the links lead to dangerous websites where users’ devices are infected with malware or passwords are stolen. Malicious content is stored in the downloads, which are often PDFs, and when the user reads the document, the malware is installed.

How to spot phishing emails:

• Most individuals are aware of some of the key signs of phishing emails. For a quick recap, some conventional indicators to consider when attempting to reduce risk include.
• Look for contact details or other verifiable information about the organization that is the subject of the spoof, and then check for things like misspellings or an email address with the incorrect domain.
• Nefarious and good code: Watch out for any code that tries to fool Exchange Online Protection (EOP), including downloads or links with typos.
• Avoid clicking on any shortened links since they are being used to trick Secure Email Gateways.
• Phoney brand logo Look through any logos that appear to be legitimate because they can include phoney or harmful HTML characteristics.
• Emails with only a single image and very little content should be ignored because they could be hiding dangerous code in the image.

2. Phishing over HTTPS

In order to strengthen security, the hypertext transfer protocol secure (HTTPS) is frequently regarded as a “safe” link to click. Nowadays, HTTPS is preferred over HTTP by the majority of trustworthy enterprises since it establishes trust.

Cybercriminals are now using HTTPS in the links they include in phishing emails, nevertheless.

Methods to spot HTTPS phishing:

• Although frequently a component of an email phishing attempt, this is a slightly subtler strategy. When determining if a link is trustworthy or not, take into account.
• Make sure the shortened link displays the entire URL and is in its original, long-tail format.
• Hypertext: These are “clickable” links that cloak the actual URL by being inserted into the text.

3. Swordfishing

Spear phishing employs email, but it adopts a more focused strategy. Open source intelligence (OSINT) is the first tool used by cybercriminals to obtain data from published or publicly accessible sources, such as social media or a business website. Then, to make the receiver believe the email is coming from someone else inside the company, they target specific people within the business using legitimate names, job titles, or work telephone numbers. In the end, the recipient acts upon the email’s directive since they think it is an inside request.

The best way to spot spear phishing:

• Unusual demand: Watch out for internal requests that originate from individuals in different departments or that seem unusual given the nature of the position.
• Links to shared drives Links to documents on shared drives like Google Suite, O365, and Dropbox should be avoided since they may take you to a phoney, dangerous website.
• Documents with password protection: Any documents that ask for a user login ID and password could be a phishing effort.

4. CEO and whaling fraud

Whale phishing, also known as CEO fraud or whaling, is a further form of corporate phishing that makes use of OSINT. To find the name of the CEO or another senior leadership figure at the company, malicious actors use social media or the corporate website. They then use a similar email address to impersonate that person. The email may ask for a money transfer or a document review from the receiver.

How to spot fraud by CEOs:

• Unusual request: If a senior leadership member has never contacted you before, you should proceed with caution.
• Email recipient: Because many people use email programmes that link all of their accounts, make sure that any request that seems reasonable is sent to a business email rather than a personal one.

5. Shinging

Vishing, also known as voice phishing, occurs when a cybercriminal phones a phone number and instils a false feeling of urgency, leading the target to act against their better judgement. These calls typically come in during stressful situations. For instance, during tax season, many people receive phoney phone calls from individuals posing as the Internal Revenue Service (IRS), saying that they want to conduct an audit and require a social security number. The recipient of the call may be duped into disclosing personal information because the call conveys a sense of urgency and concern.

How to spot phishing:

• Caller ID: The number may originate from an odd place or be blocked.
• Timing: The call comes at a stressful time of year or during a stressful occasion.
• Action required: The caller asks for personal information that seems strange for the caller’s kind.
• When there are other, more reliable ways to communicate, an unexpected call—even one from a known number or area code—should be viewed with some scepticism.

6. Pop-up phishing

Pop-up phishing is still a problem even though the majority of people use pop-up filters. When consumers visit websites, little notification boxes known as pop-ups may appear. These boxes may contain harmful code that is placed there by criminal actors. The “notifications” function of web browsers is used by the most recent iteration of pop-up phishing. For instance, the browser may prompt a user with “www.thisisabadlifechoice.com wishes to show alerts” when they visit a website. Malicious code is installed via the pop-up when the user clicks “Allow.”

How to spot phishing pop-ups:

• Irregularities: Check for misspellings and odd colour combinations.
• Full-screen mode switch: Malicious pop-ups have the ability to make a browser go into full-screen mode, thus any automatic change in screen size could be a warning sign.

7. Phishing clone

Clone phishing is a targeted email phishing assault that makes use of previously used services to cause unfavorable behaviour. The majority of commercial programmes that demand users to click links as part of daily tasks are known to malicious actors. They frequently conduct research to determine what services a company routinely utilises before sending emails that are specifically targeted and purport to be from these services. For instance, hostile actors may create bogus emails for the DocuSign service, which is used by many firms to transmit and receive electronic contracts.

How to spot copy phishing:

• Unusual timing Be aware of any unusual emails you receive from service providers, even if they are required for your regular daily job duties.
• Identifying details: Be wary of emails asking for personal information that the service provider never requests.

8. Twin evil

A phoney WiFi hotspot is frequently used in evil twin phishing attacks to make it appear authentic and perhaps collect data as it is being transferred. If someone connects to the false hotspot, the bad guys may launch eavesdropping or man-in-the-middle attacks. This enables them to gather information sent across the connection, such as login credentials or sensitive data.

How to spot a phishing scam with an evil twin:

• “Unsecure”: Even if a hotspot seems familiar, be cautious if it prompts a “unsecure” alert on a device.
• Needs logging in: Any hotspot that ordinarily doesn’t ask for login information but does so abruptly is suspect.

Email fraud, often referred to as phishing, is a deceptive practice where cybercriminals use email to trick recipients into divulging sensitive information or performing actions that compromise their security. This type of fraud is pervasive due to the widespread use of email and the relative ease with which scammers can create convincing messages. Understanding the nature of email fraud, its common tactics, and methods of prevention is crucial for individuals and organizations alike.

Types of Email Fraud

1. Phishing:

   • Definition: Phishing involves sending fraudulent emails that appear to come from reputable sources, such as banks, online services, or government agencies.
   • Tactics: These emails often contain urgent messages that compel the recipient to click on a link or download an attachment, leading to malware installation or credential theft.

2. Spear Phishing:

   • Definition: Spear phishing is a targeted attempt to steal sensitive information from a specific individual or organization.
   • Tactics: Unlike generic phishing attacks, spear phishing emails are personalized and may reference specific details about the recipient to appear legitimate.

3. Business Email Compromise (BEC):

   • Definition: BEC scams involve impersonating a high-level executive or trusted partner to trick employees into transferring money or sensitive information.
   • Tactics: Scammers often study their targets and use social engineering to ensure their requests seem plausible, often exploiting a sense of urgency.

4. Clone Phishing:

   • Definition: Clone phishing involves duplicating a legitimate email that the recipient has previously received but replacing links or attachments with malicious versions.
   • Tactics: This method exploits the trust recipients have in familiar emails, increasing the likelihood of successful attacks.

5. Whaling:

   • Definition: Whaling targets high-profile individuals within an organization, such as CEOs or CFOs, with the aim of stealing large amounts of sensitive data or money.
   • Tactics: These attacks are highly customized and sophisticated, often involving extensive research on the target’s activities and relationships.

Common Techniques Used in Email Fraud

1. Social Engineering:

   • Definition: Social engineering manipulates people into performing actions or divulging confidential information.
   • Examples: Pretexting, baiting, and quid pro quo tactics are common social engineering techniques in email fraud.

2. Malware:

   • Definition: Malware, or malicious software, is often delivered via email attachments or links.
   • Types: Ransomware, spyware, and trojans are typical forms of malware used in email fraud.

3. Spoofing:

   • Definition: Email spoofing involves forging the sender’s address to make the email appear to come from a legitimate source.
   • Impact: This technique increases the chances of the email being trusted and acted upon.

4. Impersonation:

   • Definition: Impersonation involves mimicking the style and tone of a legitimate sender, often using similar email addresses or domains.
   • Examples: Scammers may impersonate IT departments, HR representatives, or business partners.

Impact of Email Fraud

1. Financial Loss:

   • Description: Email fraud can lead to significant financial losses through unauthorized transactions, fraudulently obtained funds, and the costs associated with rectifying the situation.
   • Statistics: According to the FBI, BEC scams alone resulted in over $1.8 billion in losses in 2020.

2. Data Breaches:

   • Description: Sensitive data, such as personal information, financial records, and intellectual property, can be compromised through email fraud.
   • Consequences: Data breaches can lead to identity theft, competitive disadvantages, and regulatory fines.

3. Reputation Damage:

   • Description: Falling victim to email fraud can harm an organization’s reputation, leading to loss of trust among customers and partners.
   • Long-Term Impact: Rebuilding trust and reputation can be a lengthy and costly process.

4. Operational Disruption:

   • Description: Email fraud can disrupt business operations, especially if critical systems are compromised or funds are diverted.
   • Examples: Malware attacks can result in downtime, while fraudulent instructions can lead to delays in project execution.

Frequently Asked Questions

They possess the skills necessary to assume your identity, figure out the passwords to your other accounts, and take advantage of email-based two-factor authentication (2FA). They have the ability to steal your identity and get sensitive information.

The principal organisation that gathers scam reports is the Federal Trade Commission (FTC). Contact the FTC online or by phone at 1-877-382-4357 to report the scam.

Phishing, sometimes known as “fishing,” is an assault that tries to steal your money or your identity by tricking you into disclosing personal information on websites that look official but are actually fraudulent.

Declare it. email reportphishing@apwg.org with any phishing emails you receive (an address used by the Anti-Phishing Working Group, which includes ISPs, security vendors, financial institutions, and law enforcement agencies).

Phishing scams are the most typical method of hacking email. Because it is straightforward, inexpensive, and targets people, the weakest link in any security system, phishing is the most popular tactic.