Learning Centre : Beware of Phishing Attacks | Cyber Security Information Portal

Phishing is the attempt mainly to obtain sensitive information from Internet users by disguising as known individuals or trustworthy institutions such as banks, schools or working partners. In some cases, phishing attacks may infect and compromise computer devices with malware.

Phishing attacks are typically delivered by emails, instant messaging, forged websites or social media. Phishers may attack any time and they often carry out massive phishing campaigns during holidays or in the events of natural disasters, epidemics and major political elections, etc. Internet users should stay vigilant at all times.

1. Deceptive phishing - Phishers craft messages that look almost identical to those of legitimate institutions or individuals and conduct mass mailings so that recipients might be tricked to give out their sensitive and important personal information.
2. Spear phishing - Spear phishing is a more sophisticated version of deceptive phishing. It targets specific individuals or companies. Phishers make use of personal information available from different sources such as social media to craft personalised messages and send them to a selected group or individual, such as senior executives and top management personnel. With a smaller target size, it is easier to include personal information such as the target’s name or job title, making the message seemingly more trustworthy and difficult to be detected.

Risks:

1. Leakage of sensitive information - Phishers will disguise themselves as known individuals of victims (e.g. victims’ senior management or customers) or trustworthy institutions (e.g. banks) to lure victims to give out their sensitive information such as account names, passwords and identity information. Phishers may further use these sensitive information for malicious purpose or sell them to third parties.
2. Malware infection - Links or attachments in phishing emails or phishing websites may contain different malware (e.g. key-logger, ransomware and cryptocurrency mining malware). If users click these links or open these attachments, their devices may get infected by the malware, which may lead to data leakage, data loss or other financial loss.

Impacts:

1. Financial loss - With sensitive information obtained from victims, phishers can carry out transactions such as transferring victims’ money to their pockets. Business operations can be disrupted due to the waste of employees’ productivity on handling consequences brought by phishing such as leakage of login account and password.
2. Reputational loss - Phishers can further make use of information obtained from victims to send blackmail, intimidate victims’ contacts or even perform illegal activities (e.g. hacking into the system of the victim’s organisation to steal confidential information), causing the victims to be blamed or even get into legal and liability problems. As for an organisation being attacked, it may suffer reputation damage to its brand, and its customers may move their business elsewhere due to losing trust in the organisation in safeguarding their data.
3. Intellectual property theft - Intellectual property, including trademarks, patents, trade secrets, etc. is crucial for the success of a company. With the information obtained from victims, phishing attacks can lead to theft of intellectual property which can represent millions or even billions of research and development costs, and may even threaten the future of the company.

Phishing emails:

Phishing emails are crafted like emails sent from legitimate individuals or organisations. They usually contain threats (e.g. suspicious account activities that require immediate actions) or too good to be true offers (e.g. free smartphones). You should stay vigilant when such messages appear in your mailbox.

• Common characteristics of phishing emails:

Phishing websites:

Phishing websites are usually reached through links from phishing emails, social media or by clicking a suspicious advertisement. The phishing websites usually involve an account login page or a payment page which asks for your sensitive information. Therefore, you should always stay vigilant when visiting such pages.

• Common characteristics of phishing websites:

• Example of a phishing website:

Phishing emails can bring about serious security risks. They will steal your personal information and also infect your computers. Phishing attacks affect not only your computer but may also use your computer to compromise other computer systems of your organisation.

Take Challenges Now

(The challenges include four sample emails. Please try to identify these emails as “Genuine” or “Phishing”.)

When you receive suspicious email messages:

1. Do not click on any links or download any attachments

The links might lead you to malicious websites while the attachments might contain malware.

2. Do not reply to the email

Report to appropriate parties such as your organisation’s network administrator promptly for checking and cleansing.

3. Check the true destination of links

Hover over the link to check the destination address and scan the link with a link scanner such as Norton SafeWeb, URLVoid, VirusTotal.

4. Verify the sender

Verify the sender through channels other than those stated in the email, e.g. phone numbers found on your credit card or statement.

5. Delete the suspicious messages



Delete the message if you are confident enough that it is spam.

6. Report to appropriate parties



Report to appropriate parties, e.g. your bank. You should also consider reporting the attack to the Hong Kong Police Force if necessary.

When you click on a link or download attachments in a suspicious email:

1. Disconnect your device from the network

This can reduce the risk of spreading malware to other devices on your network and prevent malware from sending sensitive information from your device.

2. Report immediately

Report to appropriate parties such as your organisation’s network administrator promptly for checking and cleansing.

3. Perform a malware scan

Before reconnecting your device to the network, run a complete scan with your anti-malware software. Follow the instructions given by the software to remove any suspicious files found.

4. Change your credentials

Malware may have already harvested your credentials for online accounts such as email, online banking and social media. Thus, you should change your online credentials immediately to stop phishers from using your accounts.

When you have provided sensitive information to phishing emails/websites:

1. Change your credentials

Change your passwords for the related accounts.

2. Report immediately

Report to appropriate parties, e.g. your bank, your organisation’s network administrators. You should also consider reporting the attack to the Hong Kong Police Force.

When my organisation’s identity is being used in a phishing attack:

1. Alert users

Issue prompt alerts to users, related parties or even the public through press release, website or emails about the fraudulent website and warn them not to respond to the suspicious or phishing emails.

2. Report immediately

Report to the police and relevant organisations / regulatory bodies such as the Hong Kong Monetary Authority about the suspicious website.

3. Advise potential defrauded users

Advise users, who are suspected to be defrauded, to change their passwords immediately and report to the police if necessary.

4. Alert your website administrators

Issue alerts to staff, administrators or service providers of your organisation’s website to strengthen security measures and to watch out for any suspicious activities such as suspicious port scanning activities, abnormally high traffic volume from certain computer devices or connection to suspicious servers in the Internet.

1. Cyber Security Information Portal – Tips on Protection against Phishing Scam
2. Phishing.org – 10 Ways To Avoid Phishing Scams
3. US-CERT – Avoiding Social Engineering and Phishing Attacks
4. HKMA – Sample Phishing Emails Purportedly from Banks
5. HKMA – Smart Tips Against Phishing Emails