Proact Blog

Email phishing: Why do we still get hooked?

Lara Huddless, Sales Enablement Coordinator at Proact UK

We all know about phishing attacks. They’re not new, in fact they’ve been an issue for (about) the last 15 years – and are probably the most talked about security threat in the media at the moment.  So, why, in a world driven by technical progression, have we not managed to address such a fundamental problem? There’s no one answer to this question, unfortunately. But here’s a list of problems people often fall victim to.

Human psychology

In some ways, it seems unlikely that people could fall for a phishing email. Awareness is high, organisations have dedicated phishing prevention/reporting pages, and people are becoming much more attuned to what a phishing email generally looks like. Yet, phishing attacks are still being successful. Why? Because they tap into people’s fears and curiosities.

Humans are hardwired to be curious, and this instinct is generally attributed to our overall development as species: what lies across the water? What happens if I fly beyond the clouds? Ideas like this have lead us to build boats, space-ships and explore the unknown. But the unknown can be fraught with danger – and could end up installing a malware virus onto your computer. Or unlock ransomware, encrypting your files.

It’s difficult to resist that “free coffee voucher”, especially if it’s from a place you recognise and visit. Our curiosities take over. That’s not to mention playing on people’s fears and emotions. It’s been argued that fear and pressure are the most effective factors to get someone to click a link, open an attachment or reply with sensitive and private information.

I mean, what would you do if the Head of Finance or Legal (seemingly) from within your organisation, asked you to send X information, or follow the link ASAP? Would you respond or click? I’m going to guess that you might…

Simplicity

The most common advice is “don’t click links or open attachments”. Whilst this is true, attacks can be as simple as a spoofed email designed to look like somebody else, someone you might know in your own organisation. Take, for example “support_desk_proact@outlook.com” wants you to call the ServiceDesk to investigate some account activity. Or – as I mentioned above – the Head of Finance is asking you to check tax details in the following link.

There’s a dark art to attacks like this (otherwise known as spear phishing): they take time, research and an understanding of who is likely to fall victim; but they happen. A recent case in the US saw a phishing scam convince a US military supplies contractor to ship millions of dollars’ worth of iPads, TVs and sensitive comms equipment to a 3rd party – simply through an email conversation and a cleverly named email address! It can happen to anyone.

Simulation training 

Businesses do what they can to educate their end-users around phishing attacks, which normally includes sending simulated phishing emails accompanied by training material for those that make the faux pas of opening them. This seems like an elegant solution but, is it really that effective? Certainly not on its own.

Whilst training reduces successful attacks, no training can teach users to spot every phish. Spotting phishing emails is hard. Spotting social engineering emails is even harder. Not to mention time consuming! Imagine how many emails are sent/received every day – asking people to stop and consider every email in depth won’t leave enough hours in the day to do work. Remember – it only takes one email to have a potentially catastrophic effect on an organisation.

Social media  

It’s no secret – people like to share their lives with others. Be it through Facebook, Twitter, Instagram or LinkedIn (to name a few). We tell the world what we like, dislike, our opinions, where we are, what we’re doing… And, for the most part, it seems harmless and safe. But do you consider who reads these social posts? Friends. Family. Colleagues. Total strangers?

These channels are treasure troves for cyber criminals and have made it easier to collect necessary pieces of information to weave an individually-crafted attack on their victims. They’re also known as social engineering. Take the example of the coffee voucher above. A simple post saying “coffee before work”, with an image of a Starbucks, tells us that a “free voucher” link might just work.

Phishing is remarkably successful and is still the prevalent technique across the majority of cyber breaches. Simply put, until this changes, criminals will continue to do it. Business email compromise (BEC) has cost businesses, so you might say benefited cyber criminals, $26 billion in the last 3 years. This equals an extraordinarily profitable venture – meaning cyber-criminals are becoming wealthier.

As the money rolls in, their technical resources and malware variants become more sophisticated. Educated and informed employees are the beginning, but not the all. Organisations need to consider multi-layered defences – giving you multiple opportunities to stop a phishing attack, potentially causing series damage.

Proact can offer such multi-layered defence. If you’d like to know more about what we can do, complete the form below and we’ll be in touch.

Get in touch

By clicking Send now, I agree to the terms and conditions outlined in the Proact Privacy Policy.