“Phishing” refers to a scam method that relies on social engineering tactics to deceive victims into sharing data, following links, or downloading attachments.
This scam is nearing 30 years of age but shows no signs of slowing — 86% of businesses have been negatively impacted by phishing emails.
So how can you learn to spot them before it’s too late? Follow along as we detail the 10 signs of phishing attacks to watch out for.
Top 10 signs of a phishing attack
#1. Poor spelling, grammar, and punctuation
In 2023, a lack of adequate language skills has become a stereotype of phishing scams, yet it couldn’t be more accurate.
Phishing emails and messages are often riddled with errors, which signify an obvious scam.
The mistakes won’t be exclusive to the body of the message — email addresses, names, links, and phishing websites are known for spelling errors. You can copy and paste the text into a free grammar checker if you aren’t sure.
#2. There is always a payload
A consistent feature of every single phishing scam is the payload. This often takes the form of a link, attachment, or corrupted website.
Either way, every phishing scam will try to direct you toward a payload, which ultimately steals your data or funds.
Many of the tips listed here can help to spot phishing scams before you reach the payload. To keep your data protected at all times, ensure you have a VPN extension for Google Chrome.
#3. A constant and urgent sense of action
Another typical feature of any phishing scam is a manufactured sense of urgency. Scammers like to ramp up the pressure with threats of hacking, money loss, stolen data, etc. Unsurprisingly, the “only way” to avoid these threats is “Click on this link.”
In a false state of panic, you’re more likely to make irrational decisions, like sharing your data, following login pages, and more.
#4. Disguised as a legitimate source
Imposter emails are one of the most common ways that phishing scams find success. By disguising themselves as a legitimate company, victims are caught off guard, as emails from the actual company are normal.
Scammers don’t stop there. Look for cybercriminals posing as:
- High-ranking government officials;
- Banks, credit cards, crypto exchanges, etc.
- Police or government agencies;
- Travel and tour companies;
- Cybersecurity consultation firms.
Scammers want to catch you unprepared, so what’s better than masquerading as an inconspicuous and expected party?
#5. Unusual or inappropriate syntax
Similar to poor spelling and grammar, phishing messages also feature a more subtle linguistic error. Next time you receive a phishing message, take a closer look at the syntax used throughout. Did they start the email with “Dear Bank User”?
Does the phrasing seem off? The syntax is one of the hardest skills to master when learning a language. Most phishing scammers lack professional English abilities, so improper syntax is an obvious sign of a scam.
#6. Messages offer big payouts
A telltale sign associated with phishing is the “too good to be true” feeling. Posing as marketers, investors, or businessmen, scammers lure in victims with the promise of “low risk” and “high reward.”
Maybe they claim to be a financial worker who found your number online and wants to share trade secrets. Either way, you’ll likely never see that promised pot of gold at the end of the rainbow.
#7. Malicious websites lack SSL certificates
If you look at the domain of this website, you’ll see it begins with “HTTPS”. This is a clear sign that the website administrators have installed a Secure Sockets Layer (SSL) on the site.
An SSL certificate ensures your communications and browsing data are encrypted during transit. As phishing sites want your unencrypted data, they’ll be missing an SSL certificate, and their domain will begin with “HTTP.”
#8. The email address comes from a public domain
If you spot this once, you’ll likely never forget it. So many users skip over the sender’s data when opening new emails. The problem is phishing scams often use public domains for their email addresses.
No bank in the world will contact you via a private email address ending with “@gmail.com” or “@yahoo.com.” Scammers can get creative trying to hide this or justify it, but public domains always point towards an untrustworthy sender.
#9. CEO fraud is incredibly common
It was mentioned earlier that phishing scams like to hide behind the guise of legitimate sources. This has been paying off in corporate environments, where scammers pretend to be C-level executives asking for login data.
The FBI announced over $43 billion in losses from Business Email Compromise (BEC) between 2016 and 2021. If you don’t usually communicate with C-level executives, double-check that the email is credible and not an attempt at CEO fraud.
#10. A complete lack of contact details
If you’ve got the uneasy feeling that an email is a phishing attempt, check for working contact data like emails, forms, etc. The chances are that you’ll scour every corner and come back with zilch.
It’s all pretty logical, right? Scammers don’t want to be contacted, so setting up verifiable contact methods is counter-productive. If this data is missing, you’re almost definitely dealing with an untrustworthy party.
In the case of an attack…
While most of us can heed the warnings listed here, some of you may have already fallen into a phishing trap.
What to do if you’ve already clicked on a malicious link
So you clicked before properly vetting the email for telltale signs. It’s okay. However, your new job is damage control. Ensure you do the following if you think you clicked on a phishing link:
- Disconnect from the internet to contain the spread of malware to other devices.
- Scan your system for viruses with premium antivirus software.
- Call your bank and freeze any compromised accounts and cards.
- Change all passwords, emails, etc.
- Create or restore backups.
How should you react to a ransomware email?
Some malicious links, when pressed, begin a chain of events that lead to a ransomware attack. This is when a cybercriminal threatens to destroy or expose private data if a ransom isn’t paid.
If you’ve received one of these emails — don’t panic! Go straight to your cybersecurity or IT team with this issue. Whatever you do, don’t try and solve the issue on your own. For smaller businesses, consider developing a ransomware response plan.
Future phishing attacks will only intensify with AI
Wrapping up this article, it would be silly not to mention the growing threat that phishing will play in the future. Thanks to powerful AI chatbots like ChatGPT, signs like spelling mistakes and improper syntax will become arbitrary.
Strides in generative AI also improve the efficacy of social-engineering-based scams like phishing. As AI evolves into the future, so will the methods and signs of a phishing attack.
English 
Chinese