Article from First Security

By | |

Social Engineering and Phishing

Don’t Take the Bait.

Criminals Use Fake Emails to Phish for Your Information.

What is Phishing?

Online fraud and identity theft are on the rise. Cybercriminals may try to steal your personal information by tricking you to click on a fake email that looks legitimate. Criminals design these messages to trick you, so they may look like real messages from companies you trust, but with fake web links, phone numbers, and attachments. This method of email fraud is called phishing.

Phishing emails often ask for personal information to gain access to your financial assets or to steal your identity. They may also place malicious code on your computer, browser, or mobile device to monitor your activity or gain access to your other accounts. Be wary of any emails from unknown senders or spoofed email addresses.

Topics

Phishing Facts

Phishing scams can appear as emails from brands you trust.

83%
of organizations experienced a successful phishing attack in 2021.1

51%
of Americans cannot correctly identify phishing.1

Phishing accounts for
90%
of data breaches.2

How to Identify a Phishing Email

  • Poor spelling or grammar
  • Generic or non-personal greetings
  • Requests personal information (passwords, financial information, MFA pins, credit card numbers, social security numbers, etc.)
  • Unusual or unnecessary sense of urgency
  • Offers that are too good to be true
  • Emails that instruct you to transfer money or to change wire instructions

How to Identify Spoofing

Spoofing is when a bad actor pretends to be a person or organization you know and trust. In phishing scams, bad actors often spoof sender names, hyperlinks, and websites to trick you into thinking that you are interacting with a trusted source.

  • Spoofed Senders. Bad actors commonly spoof the sender’s display name so that an email will look like it is coming from someone you know. Hover over the display name to see if the email address matches the purported source of the email. You can also always pick up the phone and call the sender through a trusted phone number to confirm the message is from them.
  • Spoofed Hyperlinks. Bad actors will also disguise hyperlinks so that you cannot see the true destination of the link. Hover your mouse over a hyperlink without clicking to confirm it points to an address you expect.
  • Spoofed Websites. Bad actors can impersonate legitimate websites by making subtle changes to the website domain name, like adding an “l” and “r” to transform “firstam.com” to “flrstarm.com”. Always double-check the address bar to confirm you have not found yourself on a fraudulent website. If you have never heard of the website before, do some research on the organization before handing over your information. Call the sender through a trusted phone number to confirm the message is from them.

Did You Know that Phishing is More than Just Emails?

Fact:

According to Proofpoint’s 2022 State of the Phish Report, 72% of organizations experienced at least one vishing attack in 2022. Conversely, only 25% of Americans can correctly identify vishing.

When Working with Us:
What is FA-Secure?

If you work with a First American representative, you may hear the term ‘FA-Secure’. First American employs multiple strategies to ensure that email communication with our customers stays secure. FA-Secure is one of these strategies; it allows your representative to send you encrypted messages that require a password to open.

If you receive an ‘FA-Secure’ email, please note that the weblinks will only point to the sites listed below.

  • Secureemail.firstam.com
  • Secureemail.heritageescrow.com
  • Secureemail.etitledocs.com
  • Kiteworks.firstam.com

Did You Know that Phishing is
More than Just Emails?

Not every phishing attack will look the same. In fact, bad actors can phish for your information through a variety of different platforms, such as:

  • Voice CallsVishing, a combination of “voice” and “phishing”, is a call-based scam designed to get you to share personal information or financial details, such as account numbers and passwords. While most emails have robust spam filtering technologies, our phones are less adept at warning us of an attack and are prone to phone number spoofing. Additionally, it’s much easier for bad actors to convey emotion and build trust over the phone, which makes it easier for them to trick you.
  • Text MessagesSmishing, or “SMS Phishing”, is a text-based phishing scam. Like email phishing and vishing scams, bad actors attempt to steal your personal information, MFA codes, or passwords, or infect your devices; however, in smishing, bad actors communicate with you via text.
  • Social Media MessagesSocial media is also ripe for phishing-style scams. Bad actors can create fake individual or business profiles that appear trustworthy, and they also attempt to duplicate real accounts.

What to Do if You Receive a Phish

If a suspicious message should arrive in your inbox, here are some steps you can take to help protect yourself.

  • Never Click a Link Without Checking. Hover your mouse over the text of a link without clicking to verify the true destination of the link. The true link will be displayed in the lower right corner of your browser. On your mobile device, you can similarly press and hold down on the link.
  • Keep Your Systems Updated. Be sure to keep your operating systems, browsers, email software, virus protection, and apps updated with the latest versions. These updates will often contain fixes for certain vulnerabilities that fraudsters may try to exploit.
  • Be Careful With Attachments. If you are not confident that the sender is legitimate and the attachment is secure, call the sender through an independently verified telephone number and confirm they actually sent the message.
  • Report Suspicious Messages. Most email software (Microsoft Outlook, Gmail, and others) has functions that allow you to report suspicious emails and provide the detail of the email. You can also report any fraud attempts to the Federal Trade Commission (FTC).

Do not click links in or reply to suspicious messages. Call the supposed sender through an independently verified telephone number and delete the fishy message.

When Working with Us: Reporting Suspicious Messages and Websites

It might be difficult to tell whether a message is truly from a company you trust or just looks like an authentic communication. If you receive a suspicious communication that appears to be sent from First American or websites that look like First American, please forward the message or URL to phishing.abuse@firstam.com, and we can help you verify it.

For email messages specifically, please follow the steps below, and our security experts will investigate. These steps may take a few extra minutes but your help reporting phishing emails protects everyone.

When Working with Us: How to Forward Your Suspected Email

To enable our investigation, we need to receive the suspicious email as an attachment. For your convenience, we’ve included some instructions from some common email providers. You can also find the most current instructions from your email provider’s support center.

Outlook 2021, 2019, 2016, 2013, and Outlook for Microsoft 3653

  1. Select the email you want to forward, then go to the Home tab.
  2. In the Respond group, select More Respond Actions.
  3. Select Forward as an Attachment.
  4. In the To text box, enter phishing.abuse@firstam.com.
  5. You may enter the Subject as “Potential Phishing Email” or a different Subject of your choosing.
  6. Do not include any sensitive personal information in the email body.
  7. Click Send.

Gmail4

  1. In Gmail, select the email you want to report.
  2. Click the More icon and then click Forward as an attachment.
  3. In the To text box, enter phishing.abuse@firstam.com.
  4. You may enter the Subject as “Potential Phishing Email” or a different Subject of your choosing.
  5. Do not include any sensitive personal information in the email body.
  6. Click Send.
Tagged . Bookmark the permalink.

Comments are closed.