Cyber Explorers Escape Room: Phishing
By: Citlalin Galvan
Tags: Quick Reads, Security, Phishing, Cybersecurity, Escape Room

A quick look into phishing attacks, their effects and how to spot a bait before you are caught. Read before or after trying out our escape room!

Imagine you are a fish swimming around in your river. You eat without worries and swim wherever you like, but you start to get too comfortable…You see a delicious worm just floating all on its own. Instead of stopping for a second and questioning why a worm would be swimming in the middle of the river, you swoop in to eat it. The moment to you close your mouth, you realize you are now stuck on a hook and are getting pulled out of the water. You regret your decision. Why didn’t I find it suspicious and question the circumstances? Why was I so impatient to get there quickly? This is how phishing scams get people. People are the fish swimming comfortably while the one holding the bait is the scammer.

Phishing is the fraudulent practice of sending a message from reputable companies in order to get individuals to reveal personal information, such as passwords and credit card numbers.

Many have already experienced phishing scams through email, just by going to the spam folder of your email, you will find plenty of emails that claim to be a family member leaving you a big sum of money, all you need to do is send them your bank account number to transfer the money.

More recent phishing scams come from unknown phone calls. They can be more aggressive in their tactics and have affected many people who are not informed. They claim to be from the IRS and demand you pay them through the phone an amount you “owe” them or they will arrest you. The real IRS would never take this approach. A scam a family member of mine almost got caught on was one where someone claiming to be a cousin that was held up at an airport by immigration and the only way to get them out would be to wire transfer money to pay a fee. After calling me worried and asking me to help them pay the three thousand dollar fee to free their cousin, I asked them to start questioning the story they were being told by the cousin and “lawyer”.

Why would they ask you to send the money by money order to someone in a different county? Why were you not allowed to just drive to the airport and see the problem on your own? Why were you given a limited time to send the money?

Once I talked to them about all the red flags being raised, they still thought that the cousin was real because they sounded exactly the same. Eventually, they decided to call the cousin’s family. The cousin was safely at home and had no clue what was going on… This is a form of phishing called Vishing (Voice phishing). If they had not stopped for a bit and thought about the actions they were about to take, they would have lost thousands of dollars on a scam.

Phishing Online

Phishing scams online are plentiful and are often successful. These scams are not very complex, but they as socially engineered to attract people. The fastest way to get people’s private information is to just ask them to give it to you even if you don’t realize it. There are fake websites that pretend to be trusted sites. When you go through the fake website they will ask you to log in and as a people, we don’t always check if the website we are giving our username and password is the legit website. Sometimes the fake website is programmed to direct you back to the real website after you enter your information and click to Log In, so you never find out the crime they just committed against you. Now that you know how a phishing attack can happen, let's learn about what to look out for to protect ourselves from getting caught.

How to check if a website is real?

There is a lock icon in the website bar. DO NOT give your information to any website without the lock icon.

URL begins with https://

The website name matches the website content. May look like it is twitter.com, but when you look at URL, it says birdmessanger.com

The website name is correctly spelled. Google.com NOT Goolge.com

Is the website a .com .gov or something else, make sure it matches the website bar.

Resources

For more information on the vast amount of different phishing attacks and how to protect yourself, check out these links! I promise they are not scams.