Lessons · Cybersecurity · phishing, and what to check
Phishing: the message that asks you to hurry
Phishing is a message pretending to be from someone you trust, built to make you click, log in or pay before you think.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The finance clerk had the payment screen open. The email said the supplier had changed banks and the invoice was overdue. She stopped because the sender's address was one letter off, and that one letter was worth 48,000 dollars.
How to think about it
Check in a fixed order and do not skip: who really sent it, where the link really goes, what it is asking you to do, and how urgent it claims to be. Urgency plus an unusual request is the signature. Then verify through a channel the message did not give you.
Worked example
1. Sender: accounts@supp1ier-ltd.comRead the whole address, not the display name. A digit 1 where an l should be is the whole trick.
2. Link: the status bar shows a domain you have never seenThe text says one thing; the destination says another. The destination is the truth.
3. Request: change the bank details and pay todayAn unusual request about money, credentials or access.
4. Pressure: 'final notice, account will be suspended'Fear and a deadline, so you act before you check.
5. Verify: phone the supplier on the number in the contractNever the number in the message. Then report it, even if you did nothing.
Your turn
Write the first thing you check in a suspicious email, before the link or the request.
check first: the
Solve one, graded on the server
The trap
Trusting the display name. 'Jane Wilson, CEO' is text anybody can type; the address behind it is what the mail system actually saw.