Spear-Phishing

Warning signs

• An email that appears to be from a supervisor or colleague at work makes an unusual, urgent request for money or financial information.   
• An email or social media message from a familiar or trusted source asks for personal information, such as account passwords.
• The message contains odd grammar, poor word choices or misspellings.

How to protect yourself from this scam

• Do be as cautious with emails that address you directly as you would be with a generic message, especially if they contain links or attachments.
• Do eyeball email addresses, even when attached to a familiar name. If the message comes from an address the person doesn’t normally use, or one that contains a slight misspelling of a familiar domain, that’s a red flag.
  
• Do check links before you click them, by hovering your cursor over them to see the actual URL.
• Do be mindful that what you post on social networks might be exploited by spear-phishers. For example, if you posted about a recent business conference, a crook might pose as a fellow attendee and send you a related document that contains malware.
• Do scrutinize a corporate social media account before you engage with it. Look for signs that it is legitimate (such as the blue checkmark Twitter gives to verified accounts) and tipoffs of fakes (like misspelled words or variations on the company’s name in a URL). When in doubt, go to the company’s official website and look for its genuine social media connections.

• Don’t click on links or open attachments in an email, text or social media message unless you are certain it comes from a trusted sender.
• Don’t accept friend requests on social networks from people you don’t know. They may be scammers trying to get access to personal information from your posts.
• Don’t send sensitive personal information in response to an email request, even if it appears to be from a trusted source.
• Don’t trust a link just because it connects to a familiar file-sharing service like Google Drive, Microsoft OneDrive or Dropbox. More scammers are storing their spyware-laden files in the cloud, rather than sending documents with attachments that security software might block.
• Don’t trust a website just because it has “https://” and a lock icon in the browser window. Scammers increasingly are incorporating security certificates into their phony websites to make them look authentic.

More Resources

• Report spear-phishing attempts to the FBI’s Internet Crime Complaint Center (IC3), or to an FBI field office in your area.
• You can also report phishing to the Federal Trade Commission at its online complaint center, and to the U.S. Department of Homeland Security’s U.S. Computer Emergency Readiness Team (US-CERT) at phishing-report@us-cert.gov.