RouteOne Blog

What is Phishing?

Tweet

 

Phishing

Phishing is a form of social engineering.  Phishing attacks use email to solicit personal information by appearing to come from a trustworthy company or organization.  For example, an attacker may send an email that appears to be from a major credit card company, financial institution, or someone you know.  The email will often ask the user for personal information such as user ID and password or provide a link to a bogus website (which appears to be a valid website) asking for the same information.  Phishing attacks may appear to come from other entities that take advantages of the following:

• Natural disasters (e.g., Hurricane Katrina, Indonesian tsunami)

• Epidemics and health scares such as H1N1

• Economic concerns, IRS scams or bank failures

• Major political elections

• Holidays

Precautions to take

• NEVER provide anyone your user-ID and password, for any reason; RouteOne will never ask for this information, updates to the RouteOne website are accomplished through our software releases.

• Do not give out employee or other information from unsolicited phone calls or emails.  Verify where the caller is from and, ask for a name and phone number. Research the company and validate the person's employers. Valudate the phone number. 

• Never provide personal information or information regarding the company’s network unless you are certain that the person should have the information.

• Never provide personal or financial information in an email or by clicking on a link.

• Never click on a link in an email.  Pay close attention to the URL; most will use a variation in spelling or a different domain (e.g., .com vs  .net or .co vs .com).

• Install and maintain anti-virus software, firewalls, and email filters to reduce some of the phishing emails.

• Never leave confidential information in view of the general public. If you leave your desk, put papers in a locked cabinet and lock your computer.

If you think that you might have revealed sensitive information about the organization or the employees, report it to the appropriate person within your organization. Immediately change all passwords for each logon account. Consider reporting the event to the police and file a report with the Federal Trade Commission (http://www.ftc.gov/).