The world is becoming increasingly less safe for businesses online. As more and more people set up shop online, criminals are finding new ways to break-in. Instead of a brick through the window, cybercriminals are constantly inventing new ways to cause trouble.
This is most worrying for smaller organizations. In fact, 66% of small to medium-sized businesses have been victims of a cyber-attack in the past 12 months. Stats like this are enough to put you off going online at all.
After all, cyberattacks can be devastating. As online businesses grow more and more diverse audiences, with customers from across the world, they become bigger targets. Data leaks can damage customers’ faith in your organization.
But remember, businesses that suffer the most from online attacks are those that aren’t prepared.
So, before you do anything online, familiarize yourselves with your opponents. Returning to the ‘brick through the window’ analogy, part of the preparation for a break-in is knowing the criminals' tactics. If you know a thief is going to use a brick to break in, add double glazing.
Similarly, if your business is to stay safe online, you need to know the common practices of hackers. This is where this article comes in handy. We’ll focus on three of these tactics: phishing, vishing, and smishing (we promise we didn’t make those words up).
Firstly, no, these terms don’t have anything to do with angling. They might sound slightly comical, don’t let this lull you into a false sense of security. Together, these are practices used by criminals to gain access to sensitive information, sometimes to devastating effect.
There’s a good chance that you don’t know at least two of these tactics.
Let’s start by going through each tactic and explaining what it means.
Out of the three, this is probably the term you’ve heard before. It’s a practice that dates back to the 1970s. A lot of resources have been pumped into raising public awareness of phishing. But even though people are much more aware of this form of cybercrime, many still fall victim to it.
But if you aren’t familiar with the term, what exactly is phishing? Businesses across the world use bulk email providers to contact customers. But not all emails that you receive will be legitimate.
The simplest way of explaining this is by using an everyday example. Let’s imagine that you get an email from an organization saying that your password has been leaked and that it needs to be changed. You click a link from this email and change your password.
Or at least, you thought you did. In reality, you gave your details to a cybercriminal acting as an organization. This is phishing.
It’s a problem that all too many businesses are familiar with - Phishing is involved in 36% of breaches for organizations. People don’t pay enough attention to emails and end up compromising important business information.
Spotting phishing attempts is often easier said than done. Some scams are easy to spot, but hackers are getting cleverer. This means new ways of conning people into following links and giving away personal information.
Not all hackers operate using email, sometimes a simple phone call can be just as deadly. Even though you might not recognize the term, you’ve almost certainly been exposed to vishing.
Again, most businesses use phone marketing as a way of contacting customers. For example, brand ambassador companies use phone calls to promote products. Unfortunately, scammers sometimes impersonate companies using phone calls to obtain personal information.
You pick up the phone to speak to someone, seemingly from a friendly organization. Throughout the course of the call, this individual will try and persuade you to part with sensitive information. Hackers will go extreme distances to seem credible. This could mean making several phone calls, not necessarily asking for details on the first call.
Don’t be surprised if a scammer is armed with your name and address. People are accustomed to businesses personalizing customer service. Scammers arm themselves with the right details to seem trustworthy.
It’s not difficult to see how this sort of attack can be troublesome for businesses. This is especially the case if employees aren’t properly trained to spot a scam. A worker might leak information thinking they are speaking to a friendly company.
Of course, sometimes vishing doesn’t involve speaking to a human. Hackers often opt for automated systems to make as many calls as possible. These scams are much easier to spot but can be equally deadly.
An individual poses as an organization to leak sensitive information. The difference is that smishing is carried out through text messages rather than email.
Again, you might not recognize the term, but you’ve probably been targeted with smishing. On the surface, smishing is very similar to phishing and vishing. You’ll get a text asking you to log on to a website and input your details. Of course, this is actually a scam.
More and more hackers are now choosing smishing as their chosen method of attack. There are now 6.5 billion smartphone users in the world. That’s a lot of people waiting to be scammed, and hackers haven’t missed out on this opportunity.
For businesses, smishing can be as equally as troubling as phishing. Whilst the threat isn’t as direct (a virus sent from an email can affect an organization’s computer systems) it can still produce a lot of problems. All a worker needs to do is input a password, and a hacker gains access to your systems.
Sometimes it can be easy to spot a scammer. The most obvious scams usually involve a poorly worded text message or email informing you that you’ve won some money. But as we’ve already noted, scammers are becoming increasingly clever.
Instead of a poorly worded email, you’ll receive emails that look professional. Mail might even contain the correct color scheme and layout of an email from a legitimate company. Similarly, it won’t always be obvious when a text message is a scam. A message can be convincingly written and might even appear under the name of a real company.
Phone scammers too are becoming more and more deadly. They’ll gather enough information to make their calls seem believable and follow the same scripts and screenplays as legitimate companies.
So, if scams are becoming so difficult to spot, how can you identify them? And what can you do to prepare your business against attacks? It’s good to start by having your employees deploy the following tactics.
Hackers don’t usually take the time to target people individually. Whilst phishing is still one of the most effective tactics used by hackers, most people ignore scam emails/texts. Hackers send out scam messages in bulk to have a better chance of being successful. They’ll use generic language, instead of addressing you by your name, an email will say ‘Dear Sir/Madam’.
Typically, the language used by a scammer won’t be the best – the first language of hackers is often not English. You’ll probably notice grammatical errors throughout the message. The form of English used can also be a warning sign. For example, you might use US English, whereas an email or text is written in UK English.
Of course, some hackers are cleverer and use competent language to seem professional and believable. So, what do you do if a scam email is written convincingly?
Scam emails work by having a user follow a link to a website. Of course, not every text message or email that contains a link is spam. Companies use automation customer service to contact customers when responding to queries. These messages often contain links.
So how do you tell the two apart? Whilst hackers might be able to replicate the website of an organization that they are pretending to be, they can’t replicate the URL.
A simple test is to compare the URL in the message vs the correct URL of an organization. If the two match, there’s a good chance that the message isn’t spam. Make sure you look carefully, as a hacker could create a URL that is similar to the correct website.
No reputable company will be contacting you from a public email address. Similarly, a message from a company won’t come from a personal phone number. Instead, you should see the name of the company (e.g., Amazon).
If a message comes from either of these sources, it should be a red flag. So, remember, always check a sender’s address before opening any links.
If a caller is claiming to represent a government agency such as the IRS, you should proceed with caution. Government departments don’t contact you unless you have requested them to. Also, under no circumstance would an agency contact you and request personal information such as passwords.
Scammers know that fear can cause you to act irrationally. If you get a call threatening police action or fines, try to keep a level head. Ultimately, a scammer is trying to make you part with important personal information. Even if a caller sounds convincing, make sure that you keep your details to yourself.
If you’re unsure, it’s better to call the organization that the caller purportedly belongs to. That way you can verify the caller and make sure they are legitimate.
Training isn’t always the favorite tactic of businesses, costing money, and time. But when it comes to cybersecurity, you don’t want to cut any corners. We’ve already established how devastating scams can be to your organization. It’s better to arm your staff with the skills they need to spot any wrongdoing.
With the right software, you can make sure that you’re only receiving communications from people you want to speak to. For instance, it’s a good idea to set up a whitelist for your emails. With a whitelist, you can only receive emails from sources that you approve. It’s also a good idea to invest in online team communication tools for enhanced security in calls.
Of course, phishing, vishing, and smishing aren’t the only threats posed by hackers. Cybercriminals have other, more sophisticated ways of breaching your systems. You’ll need the right software to guard against these attacks.
For example, a Virtual Private Network (VPN) can be extremely useful. When your employees are on the move and are using public Wi-Fi, their web traffic isn’t protected. The right VPN helps encrypt traffic, giving you complete anonymity on the Internet.
With online scams on the rise, people are constantly on the lookout for trouble online. This means that as well as being prepared for scams, you need to prove to others that you are credible. This means making a professional-looking website, but it also means focusing on creating the best content.
For that, you’ll need to know how to create pillar pages - main pages that show expertise around a particular topic.
Cybersecurity problems aren’t going to go anywhere. In fact, as more and more businesses head online, these problems are only likely to increase. Phishing, vishing, and smishing attempts will be common. You shouldn’t be surprised if you open your emails and find a phishing attempt.
The only way to protect against these attacks is to prepare. Educate yourself and your staff about the best ways to stay safe online. Always be alert for scams and never click on any suspicious links. When partnering with other businesses, make sure your contracts reflect your security requirements. It’s great to use a service contract template to speed things up but don’t forget the details.
Many businesses aren’t prepared for cybercriminals, make sure you’re not one of them. With the right knowledge, you can make cyber worries a thing of the past.
