Every year, Checkpoint Software Technologies, a prominent IT security firm, publishes lists of the most common phishing attacks and which brands, specifically, are most commonly impersonated. Their report for quarter 4 of 2021 continues some old trends and elucidates some new ones, indicating how cyber criminals use social engineering to compromise accounts.
Microsoft Is Still The Big One
Statistically, most technology users are using some kind of Microsoft product, whether it ‘s Windows, Microsoft Office, or Outlook.com email. Scammers take advantage of this by sending links with bogus attachments or documents that take you to a screen which looks an awful lot like a Microsoft account sign in page. They can easily use the ubiquity of the brand to slap some familiar logos onto a page and attempt to lull users into a false sense of security.
Rising Retail And Logistics
Years into a global pandemic, many people have changed their habits (perhaps permanently) to far more online shopping. This means scammers and cyber criminals can count on the fact that a significant portion of their targets are probably expecting a package from Amazon or other online retailers. Logistics company DHL has moved into the second-place position, just behind Microsoft, in the list of most impersonated brands. The typical phishing attempt for DHL or other delivery services is a message saying your package is available for pickup. Even if the target isn’t expecting a package, they might click on the link out of curiosity (did someone send me a surprise gift?) and be presented by a login screen, requesting an email and password.
The Brands
According to Checkpoint, these are the 10 most impersonated brands:
- Microsoft (related to 43% of all brand phishing attempts globally)
- DHL (18%)
- LinkedIn (6%)
- Amazon (5%)
- Rakuten (4%)
- IKEA (3%)
- Google (2%)
- Paypal (2%)
- Chase (2%)
- Yahoo (1%)
What Should You Do?
Only engage with these companies through their official websites. Most of these companies will never initiate contact with you via email unless you’ve started a ticket or transaction. Be extremely wary of links or attachments in the body of emails. If a company emails with you, examine the address by hovering your mouse over the sender. If the email address appears to be a random string of characters or from a domain not run by that company, just go ahead and delete it. It should also be noted that these companies almost never call you and if they do, they won’t need to remote into your computer. Don’t give anyone access to your computer, unless it is a professional IT company that you initiated contact with to deal with a problem.
If you have questions regarding email security for your business, reach out to Mankato Computer Technology today—your trusted, local, IT experts.