Delivering hands-on learning in the most secure way | Penetration Testing | Product Security Engineer at Skillable, where people learn by doing
How many signs of phishing can you spot in this email? I am getting more and more of this exact type of fake invoice phish. In fact, a lot of them aren't even getting caught by spam these days. So, let's spread the security awareness to help others avoid falling for it. How many signs of phishing can you spot in this image? Alternatively, what common signs do you NOT see, which is likely how it is avoiding spam filters? Here is what I see on this one (SPOILERS): 🔻 From a generic gmail.com account 🔻 No personal greeting - it is all generic 🔻 The ID number in the subject doesn't match any other numbers in the email or the Invoice number in the attached PDF (visible but hard to see here) 🔻 The text is repetitive and very difficult to read 🔻 The PDF says "Norton from Symantec" but the email doesn't contain any branding or contact details Now, here is what I DON'T see which security awareness programs always highlight: 🔹 Call to *urgent* action 🔹 A link to click 🔹 Typos or spelling errors (grammar problems not withstanding) So, what actions can you tell people to avoid falling victim? 🔸 Never trust incoming email, particularly from sources you haven't seen before 🔸 If an email says you paid a bill you don't remember paying, check your bank accounts FIRST. If you don't see the bill, the email is almost certainly spam. 🔸 Never be afraid to forward an email like this to somebody else and ask for a second opinion on it. 🔸 Don't call the phone number or respond to an email like this. Look up the company in Google and call the official support number. #security #cybersecurity #spam #phishing #securityawareness