The game is up for scammers and phishers who seduce you with promises of wealth from a long lost relative. They have a new game in town and it’s our responsibility to be aware.
Astute phishers have leveled up and traded on your lost relatives for cybersecurity warnings, or urgent business matters. The most common subject lines of phishing emails intended for businesses “demonstrate how cybercriminals are utilizing urgency, personalization, and pressure to trick victims into clicking on malicious links, downloading malware, or otherwise disclosing confidential or sensitive corporate information,” according to a recent ZDNet article.
In other words, criminals create urgency to get your staff to react hastily. Additionally, this strategy actually works and is, unfortunately, having higher and higher success rates. Phishing-related breaches were the most common type of breach, with 53% of businesses reporting them. Thankfully, there are actions you can do to provide your team the knowledge they need to avoid phishing frauds. Teaching people how to spot a phishing email’s subject line is one of the best security awareness strategies you can use.
1. Password Check Immediate Attention Required
The subject line is quite cunning considering that is a global request that everyone is acquainted.
It capitalizes on a problem that affects offices worldwide – expired passwords. The average employee is responsible for managing dozens of passwords, some of which have set expiration dates and are time-sensitive. As a result, when they receive an email reminding them that their password needs to be updated, it’s being presented as a useful reminder. But it’s anything but that.
You will be sent to a bogus website by the link, where your employee’s login details will be obtained. The account is immediately accessible to the hacker! Additionally, 1 in 8 employees will mistakenly share information on a phishing website, making this a perfect training opportunity.
Be on the lookout for a few common changes to the subject line of this email, like:
- Password has to be updated immediately.
- Office 365: Change your password right away.
- Account Password Reset in Slack
2. Out of Date Billing Information
Cybercriminals have been known to assume the identity of outside providers in order to access a company’s financial resources. Sending an email claiming that the billing information for a specific account needs to be altered is one of these strategies. Unaware employees may click a link to a fake website and provide billing data, giving thieves access to the company’s bank or credit card information.
3. Payroll Delays
Payroll is the life force to your employees. Any perception that their funds might not be available when expected will encourage that employee to race to rectify the situation. The employee will be directed to a phishing website in quest of an explanation, where it will steal their login credentials without informing the legitimate payroll department.
4. Attendees are Waiting (Zoom)!
It’s in our nature, we don’t want to make others wait. When you’re stuck in traffic right before an important meeting is about to begin, you know that feeling of impending dread.
Hackers have replicated that horrific scenario in your email. You’ll probably get malware when you click on a link to the “meeting room” that has the word “attendance” in the subject line.
Zoom is being exploited by hackers accessing through phishing attacks.
5. New Company Information Post Pandemic
Employees may be duped by phishing emails that appear to be important information regarding your company’s policy for reentering the hybrid work environment or COVID 19 policies. After all, you’re much less inclined to scroll past an email that seems important to your career. This is why con artists typically utilize lofty-sounding subject lines. In the wake of COVID-19, a timeframe for the office’s reopening or a vaccination policy may be alluring enough to open….and then the destruction begins.
6. COVID-19 Confidential Information
Oh, what is that? Unknown information about vaccinations? A list of really secure test sites? Because they make us feel important and special, secrets are something that people appreciate keeping. Additionally, there is more pressure on us to click on emails that claim to contain information that could change our lives, like COVID-19.
It might be a good idea to warn your team about COVID-19 phishing emails if you haven’t already. As long as novel COVID strains continue to grab headlines, your employees are at risk.
7. Communication from HR
Attackers may attempt to give themselves more credibility by posing as Human Resources in their emails. One of the most commonly clicked attacks relates to updated employee restrictions for benefits like vacation time.
Keep in mind that employee portals are frequently the only means to access HR materials. That suggests that hackers might try to use a bogus website or portal to acquire the login credentials of your employees.
8. Salary Increases
Any conversation regarding compensation, including annual raises, Christmas bonuses, and everything in between, will catch your employees’ attention. Scams coming directly from the company’s HR department and claiming to be about a raise are on the rise. There is a link to or attachment of a spreadsheet that claims to display the employee’s wage increase. Sadly, the link will send you to a bogus login screen where your employee credentials will be compromised. The only person who makes money is the scammer!
This type of phishing scam has made headlines recently, mostly because website hosting company GoDaddy was the victim. GoDaddy earned adverse press coverage after it sent a phishing email to its employees stating that they had received a $600 Christmas bonus (which did not exist). Many ethical questions were raised by the exercise, which involved testing an employee’s security awareness by exposing them to such blatantly emotional material.
9. Dropbox: Document Shared
Many businesses use collaborative platforms like Dropbox to enable the real-time sharing of files like documents and critical images among coworkers. Unfortunately, file attachments are a common way for malware to spread. Furthermore, 13% of recipients of infected attachments will actually click on them. Hackers will attempt to spread infected files by pretending to be a Dropbox email and tricking their victims into downloading the document.
10. Suspicious Account Activity Detected!
ACTION REQUIRED! REQUIRES IMMEDIATE ATTENTION! MALWARE SUSPECTED! Since this subject line begs for additional information, your staff will be eager to read the email. The biggest security issue occurs when users submit their credentials when they arrive, which is mandatory.
11. Remote Work/Freelance Work
In today’s gig economy, many people desire to balance their primary job with other sources of income by pursuing side projects. Hackers that promote fake work-from-home and freelancing opportunities frequently target sites like this. These hackers may steal anything from sensitive information (such as Social Security numbers and bank accounts) to actual money, depending on how complex the plan is, by claiming it covers onboarding supplies like computers and tablets.
PHISHING TRAINING IS A MUST FOR EMPLOYEES
Phishing emails are effective because they prey on trends and emotions. They have an uncanny way of catching the best of us off guard. You can keep your team out of danger by providing them with phishing training. The more your staff knows about phishing the less likely they are to fall prey to these attacks.
Both cybersecurity seminars and phony phishing attacks are excellent ways to stop your employees from falling into a phisher’s trap. Even if they accidentally clicked on them, urge your team to report any phishing scams they come across.
- Only 3% of employees report receiving phishing emails, but if that number were higher, the likelihood of harmful phishing on your company’s network would be significantly lower.
