What If Phishing Were Crocodiles Waiting In The River?

Imagine taking a walk on the riverside. Everything is tranquil and peaceful. Suddenly, something in the river catches your attentions – a crocodile, lurking patiently underneath the water. A simple misstep could get you bitten.

Phishing emails are similar to crocodiles in the way that they may look normal at first glance, but a careless action could lead to dire consequences. Understanding how to avoid phishing attacks is comparable to staying safe around crocodiles – and this page will help with learning the water. The analogy and practical takeaways will be discussed below.

The River

People get their livelihood in a river. Every day, users navigate a digital river of emails, websites, and other technology. As they go about their business, users deal with bills, purchases, and other financial and personal matters. Each one of these is an opportunity for a crocodile to get someone.

Scammers imitate familiar companies to get users’ attention. All it takes is one curious customer to interact with a bait and a crocodile will strike.

In the same way, the river is used by people every day, emails, and other technologies are utilized by both regular users, as well as phishers and attackers.

Crocodiles do not have to wait for an entire river to pass by before attempting an attack.

Similarly, phishing scams only take one person to bite on a bait before they can attack.

The Crocodile: What Is Phishing?

Phishing is an umbrella term for cybercrime that utilizes bait to lure victims into giving away valuable information, such as credit card or banking details. This technology-centered form of scam can come in a range of different methods – email, phone call, QR code, websites, SMS, and through the use of other applications and technology. Some examples of common phishing targets are below.

Types of Information Targeted by Phishing Attacks

1. Login and password information for online accounts
2. One-time verification or code word
3. Banking and credit card information
4. Personal information, including account recovery details for online accounts
5. Access to work accounts or devices

Specifically, there are variations of phishing called ‘Phishing Websites’ and ‘Phishing Emails.’ While the former attempts to physically take information from a user, the latter attempts to get a user to physically give information to another.

The Bait

Crocodiles do not rely on speed – they rely on patience. Scammers also tend to rely on psychological tricks to catch victims off-guard.

A crocodile uses bait to get its victim to come close. Phishers and other types of attackers use similar technology-based baits to lure victims. The most common phishing messages are listed below.

1. Bank-related phishing – This bait usually consists of ‘Suspicious activity detected on your account’ or similar statements.
2. Delivery phishing – This type usually involves some kind of a ‘hold on delivery’ and a promise that a small fee will be required to unfreeze it.
3. Company-related phishing – A similar line is used that involves an immediate need for a purchase of some sort, usually gift cards.
4. Email-related phishing – The email sends out a warning that states something along the lines of ‘Email will be suspended unless you [confirm] this.’

In short, an urgent message such as a threat, promise, or surprise can act as a potential bait for phishing. As such, the best course of action for the common person is twofold – do not bite and double-check if the email or website is real. While a crocodile may hide behind murky waters, the same can be said for phishing – double-checking is always the best course of action to stay away from dangerous waters.

Six Different Ways A Crocodile Can Lure You In

There are many ways how one can get caught in by a crocodile. Similarly, there are also many ways how one can get caught in by phishing attackers. Listed below are six ways a crocodile can attack to show an example of what to look for when examining potential phishing scams.

1. Users are threatened if they do not take action in the next 24 hours or less
2. Messages ask to transfer a password or another verification word, such as a code
3. The link the message provides leads to a suspicious address.
4. There are suspicious attachments that ask the user to do something without checking the source
5. There is an offer that is too good to be true and a user is asked to send money to take advantage
6. A trusted source reaches out and asks for something unusual

As there will be variations for each of these, there are also ways how to spot a crocodile, both in the wild and in the digital world. Each one of these signs can point to a scam. In that sense, recognizing red flags is an important precautionary measure against phishing-related scams. However, it is also important to understand that not all deception is easily seen – variations of phishing emails occasionally utilize correctly spelled words, so verification is an even better way to stop an attack in its tracks.

Staying Away From Crocodiles: 6 Signs of A Scam Email

In addition to staying aware of our surroundings, there are also precautions that could be taken in order to remain safely on the riverbank.

1. Always remember to ask for verification. Usually, this involves going to a specific company’s email or website or asking for specific phone numbers to contact.
2. Always remember to use a password that is unique to the service you are trying to reach – having a unique password for each company reduces the risk of being hacked.
3. Double-check to ensure that you are using multifactor authentication as the first line of defense against phishing scams.
4. Always remember to update the program or application you are currently using. This is especially important for phishing-resistant multifactor authentication systems.
5. Provide training in phishing awareness for company members to ensure that staff know what to do in case of an incident
6. Always remember to back up important information – in general, a good cybersecurity plan is always the foundation of good protection against phishing and other cybercrimes. Additionally, for larger enterprises, account management, website management, access control procedures, and policies should be implemented. A detailed list of services that we offer can be found here.

What Do You Do If You Already Bit The Bait?

If you have already clicked on a link or given away a password, there are still measures that you could take in order to limit the damage that a phishing scam could do.

If you gave away your password, change it as soon as possible and make sure that you change it on any other service where this password could have been used. If you gave away a verification word or any other banking-related information, contact the banking service provider directly. Ask if there is a way to cancel any transactions that have already been made. You could report the message through the email or application program that you have received the phishing message through. If you have opened a suspicious attachment, close the window if you are on a personal device or contact tech support if you are on a company device. They will be able to let you know whether or not there is a way to prevent malicious programs from accessing your device. Additionally, if you opened an attachment from an email, the best thing to do is to go to the spam/junk folder within your application or website and make sure that this address is marked as spam.

Conclusion: Let Us Learn To Distinguish The Water

This page on phishing scams was created using an analogy with crocodiles. Both analogies demonstrate the fact that scammers utilize common, easily accessible resources to commit scams. A crocodile can disguise itself among the murky waters of the river. Similarly, the word ‘Crocodile’ might not suspiciously appear in an email that someone receives. It is essential that every person knows how to look out for themselves and their colleagues to prevent phishing scams. At Arish IT Services, we value the cybersecurity of our clients. We believe that learning the dangers of the digital world is also important – that is why our blog is available to help keep our clients aware of the potential scams, phishing or otherwise, they may be exposed to.