Email spoofing 101: a quick guide to protecting your business
Email spoofing attacks have become one of the top cyber attacks in recent years. And they’re one of the most effective ways that online thieves can steal an unwitting person’s data or money.
Spoofing is when an email’s header is forged so that the message appears to come from someone or somewhere else other than the actual sender. Spoofing is often used by spammers and can be accomplished by changing your “FROM” email address.
The purpose is to gain the user’s trust and dupe them into downloading malicious content, releasing sensitive data or mistaking a link as being otherwise recommended by a trusted source.
We want you to be protected. That’s why we’ve put together this handy guide to help your business successfully avoid email spoofing attacks.
Related: The top 9 threats to your data
Why does spoofing work?
Spoofed emails often make it past your firewall, which makes them pretty dangerous. Without getting too technical about how that happens, let’s just assume the spoofed email has already landed in your inbox. Should you miss that the email is not legitimate, several things could happen. You might:
- Click on an attachment that you assume is legitimate, only to release malware or ransomware into your network.
- Unwittingly provide login credentials or other sensitive data to someone under false pretenses, leading to anything from identity theft to fraudulent bank transfers to data theft.
- Possibly enter into a dialog that releases business secrets or other sensitive data to the thief on the other end.
The attacks come in a variety of shapes and approaches. Most of them aim to compromise sensitive data or siphon off money in some way. So how can you protect your business?
The email spoofing solution
The key to avoiding spoofing attacks is learning how to recognize these malicious emails. A portion of this sounds like common sense. And in a way, it is. You just need to have your radar up. Here are 5 quick tips to help you out.
- Don’t trust the display name. Check the domain address. Often spoofed emails will come from a domain other than the official domain of the organization contacting you.
- Don’t take anyone or anything at face value that asks for sensitive information. Always verify, and always use common sense. Almost no professional organization will ask you for sensitive information or login credentials via email.
- Look for poor grammar and spelling. A lot of spoofing attacks come from foreign entities. You’re probably familiar with that Nigerian prince who always seems to need help getting his fortune into the right bank. View every email (even those from trusted sources) through a lens of professionality. If the language is anything less than business professional, beware…
- Watch out for urgent language in subject lines or the email body. Often spoofed emails try to create a sense of urgency in order to get you to act with haste or without thinking clearly.
- Look before you click. Often, spoofed emails present links (or linked text) under false pretenses. Click on these links and you might download malware. To avoid this, hover over the link with your cursor and inspect the destination. Even if the address the link forwards to seems valid, put it in context with the above tips before deciding whether it is safe to click or not.
Related: 3 reasons offsite data backup is a must
Keep in mind that this is just a quick guide. And also, that the employees in your company require training and education about spoofing. It only takes one uninformed or negligent user to compromise your data. No matter how good your firewall or network security is, it will be irrelevant if an employee opens the gate to attackers.
If you have more questions, we’re always free to chat!
Related: 3 AI predictions for the near future