As organizations have become increasingly reliant on technology,  it comes as no surprise that phishing attacks are more widespread and more sophisticated with each passing day. While technologies have evolved rapidly, the human element has been slower to adapt — creating gaps that threat actors have found to be very lucrative to exploit through social engineering tactics. 

Phishing attacks come in many shapes and sizes. Some are more sophisticated than others, but all can have the same disastrous impact on your operations. While the following list is by no means complete, here are some tell-tale signs that might indicate the email you receive is an attempt at phishing:

• A lack of personalization. If you receive an email that purports to be from an established vendor, but it’s not directly addressed to you — think “Dear Customer” or “Dear User” — it might be a sign of a phishing attempt since most leading brands use personalization in their email marketing efforts. On the other hand, phishing emails are often sent to as many people as possible at the same time, which makes a more generic greeting the default.

• Typographical and grammatical errors. While no one is a flawless writer, most professional emails are well-written, edited, and largely free of typographical and grammatical errors. If you notice several errors in an email, it very well could be a phishing attempt.

• Attachments. If a company emails you out of the blue asking you to download an attachment to gain access to your account, there’s a good chance it’s a phishing email that you shouldn’t engage with.

• Unfamiliar domains. Sometimes, a phishing email will appear as though it comes from a verified sender only to fall apart under further scrutiny. For example, an email that purports to come from Fidelity might be sent from a near-name fake website like Fidelity.co instead of the company’s real webpage domain, Fidelity.com.

• Requests for sensitive information. In virtually all instances, companies will not ask you to share bank account information, login credentials, credit card numbers, employee phone numbers or similar private information over email. Should you receive a message asking you to send sensitive data over email, it may very well be a phishing attempt — one that could lead to ransomware, wire transfer fraud, or identity theft. To avoid being duped by a bad actor, Coalition recommends implementing a “dual control” process that includes calling the requestor on a known number to validate their request and verifying the nature of the request with another executive at the company.

• Sense of urgency. If an email message tells you that you need to do something immediately — like click a link to update your account credentials right this second — it may be a threat actors’ attempt at stealing your login information.

All this said, it’s important to remember that hackers’ tactics are always evolving. So, even if this section included every single sign that might indicate a phishing email, it’s only a matter of time before phishers adopt new methods. For this reason, it is critical to stay vigilant and always be on the lookout for suspicious emails.

While businesses might not be able to eliminate email phishing attacks entirely, they can take proactive steps to drastically reduce the likelihood the organization is impacted by them. Some ways to prevent email phishing include using:

In addition to these tools, organizations can also reduce the chances they fall victim to a phishing campaign by regularly training their teams on what phishing attacks are, how they can proliferate into a full-scale cyber attack, and what to look for. While they’re at it, they can also teach employees the importance of password hygiene and what a strong password looks like. Additionally, companies can consider educating customers on what to look for in phishing attacks to reduce the chances they’re victimized by someone impersonating the organization.

If an organization has been on the receiving end of a phishing attack, they should mark the message as spam, block the sender’s email address from contacting anyone on their domain, and report the attack to their internal IT teams. According to the Federal Trade Commission, victims should forward suspected phishing emails to the Anti-Phishing Working Group and also report the attack to the Federal Trade Commission. Additionally, the company’s email provider likely offers tools that make it easy to report phishing attacks to them in just a few clicks.

Coalition’s Active Insurance is designed to prevent phishing attacks before they occur. We do this by proactively leveraging cybersecurity tools and threat intelligence to keep policyholders safe before incidents happen. At the same time, we also offer coverage that protects businesses when these attacks occur, as well as guidance that helps minimize the impacts of these incidents.

If an organization is the victim of a phishing attack and they are Coalition policyholders, we will pay the costs associated with:

• Creating a press release and a public-facing website that notifies the organization’s customers about potential phishing attacks.

• Reimbursement for any loss that stems from a phishing attack.

• Removing websites that are attempting to impersonate the organization.

Coalition’s effectiveness is guided by a three-pronged approach to Active Response, which offers robust protection before, during, and after incidents:

1. Security support center. Our one-of-a-kind, in-house technical support team ensures policyholders know the vulnerabilities and cyber risks they face — and the remediation options that are available to them should an attack occur.

2. Coalition Incident Response (CIR). When incidents occur, our staff — which includes incident responders, forensic specialists, and security engineers — responds right away, ensuring claims are dealt with swiftly. Policyholders have access to these folks 24/7 until the incident is resolved, which could mean the difference between a massive disruption or what ultimately amounts to a minor blip.

3. Claims. The Coalition claims team, staffed by privacy attorneys and legal experts, help clients recover quickly when disaster strikes. Whether you need to claw back lost funds, engage with vendors and law enforcement, cover breach costs, or even respond to cyber extortion demands, our claims team is just a phone call or email away, standing by to make the process as efficient and cost-effective as possible.