Beware of the dreaded phish.
No, not the hippie stoner band Phish (though you should stay away from them, too). I’m talking about phishing scams, where nefarious internet shysters pose as legitimate companies to try to defraud you into giving up your financial info.
Phishing scams have spiked in the past few months… and contractors seem to be especially juicy targets. In fact, some charlatans tried to phish one of our clients last week.
Here’s the story, along with 5 steps on how not to get hoodwinked by these losers…
Last Thursday, our client received an email from a reputable cloud security company. They said someone with the email address from a legitimate cloud backup company set up an account in the client’s name.
Here’s a look at the email our client was sent:
The email our client was sent regarding the suspicious account setup.
Our client was confused and slightly suspicious, as she had no knowledge of being signed up for this service. The anti-spam warning at the bottom of the email (kudos to the cloud security company for including it) shot her BS meter to “Full-On Bull Crap.” So she contacted us to ask if we created the account for her.
We did some internal research, which told us what we already knew—no one at MYM created the account. We don’t sign up our clients for anything without letting them know prior.
Our Digital Services Director hopped on a live chat with the cloud security company to figure out what was going on. The company confirmed that our client’s name was not in their database.
Do you smell that? I’m getting a whiff of something… phishy.
(Sorry, couldn’t resist.)
We told the client the email was likely fraudulent and to ignore it—the whole scenario seemed way too suspicious to be legit.
Sometimes, however, phishing scams are harder to spot at first glance. If you find yourself receiving a cryptic email like the one our client received, here are 5 ways to detect a phishing attempt:
-
The email asks for personal info
Legitimate companies almost never ask for personal/financial info from out of the blue—especially by email.
-
You didn’t instigate the activity
If you receive an email or a phone call telling you to you need to enter personal information to complete your account setup for something you did not initiate, run away fast.
-
The message is threatening
Phishing scammers will sometimes threaten to close your bank account, cancel a service, or seize your assets (or something of that nature) unless you take the action they tell you to. In 99.99% of cases, this is a phishing attempt—real companies generally do not send out these types of intimidating messages.
-
Phony URLs
In some phishing attempts, the email URL displayed in the message is different from what it’s hyperlinked to. In addition, phishers usually try to pass off as an authentic company by including real company names (ex: “Priceline,” “Microsoft”) on the left side of the @ symbol. Real companies, however, have their name on the right side of the @ symbol.
-
Go with your gut
Studies show that human instinct is right more than it’s wrong—it’s our own personal BS meter. If your gut is telling you something is “off” about a particular email or phone call, it’s probably correct.
Follow these steps, and you’ll become 100% phish-proof.
Have a great day!
-Rich
P.S. Phishing scams can also happen by phone. Over the weekend, one of our Senior Copywriters, Nick Nordstrom, was also a target for a phishing attempt. A mysterious person posing as an Expedia employee (calling from a non-Expedia phone number) left Nick a voicemail. He said Expedia was having trouble finalizing his upcoming trip and that he needed to call them back “as soon as possible.”
Listen to the voicemail the phisher left. It’s hilarious how badly the guy botches the attempt–the awkward silence at the 28-second mark is particularly cringe-worthy. You can obviously tell it’s his first day in Scam Artistry 101.
© 2016, Rich Harshaw. All rights reserved.
