![\"\"](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2022\/03\/linkedin_phishing_email-1024x671.png\")
It would be great \u2014 if it was real.<\/p>\n
But I don\u2019t use LinkedIn \u2014 for reasons to do with privacy, surveillance, and a general reluctance to entrust my details to a company that habitually loses customer data<\/a>. The messages, therefore, could not have been sent to me by LinkedIn. So who sent them, then?<\/p>\n The quick ego boost I experienced from the email subsided as I realized that no one was particularly interested in my career, and that I\u2019d almost<\/i> been hooked by a phishing scam.<\/p> \n Criminals on the internet are not a new phenomenon and they have a number of aims. The most obvious one is to try and steal money from a victim\u2019s bank accounts. Other criminal groups may try to use a victim\u2019s account to gain access to a larger organization. Often, they try to take control of a victim\u2019s machine in order to encrypt and\u00a0ransom<\/a> the contents, or to suborn it into a\u00a0larger criminal enterprise<\/a>.<\/p>\n But hacking other people\u2019s computers is difficult, time consuming, and potentially dangerous \u2014 especially if criminals are indiscriminately targeting a large number of people.\u00a0<\/p>\n The easiest way to get hold of an individual\u2019s username and password is to ask them; there\u2019s no simpler way of installing malware on a victim\u2019s machine than giving them a button to click so they can download it themselves.<\/p>\n Phishing (pronounced \u201cfishing\u201d) involves sending deceptive messages that persuade potential victims to hand over their credentials or visit sketchy webpages. To be successful, the messages must be believable and make victims want to click through.<\/p>\n Spear phishing is a more refined form of phishing that targets specific individuals or groups of people. Criminals spend time studying individuals, gathering data on them in order to send highly specific messages that they\u2019re more likely to open. Social media is a great source of information when crafting emails for spear phishing.<\/p>\n If I had clicked on any of the links within the email sent to me, it\u2019s likely that I would\u2019ve been redirected to an exact replica of the LinkedIn login page, with a custom URL alerting criminals that I\u2019d opened their message. As soon as I visited the dummy webpage, they would\u2019ve known it was me, because I was the only person who was sent that exact URL.<\/p>\n I would\u2019ve entered my username and password, and after that, I may even have been redirected to the genuine<\/i> LinkedIn login page. At that point, I\u2019d probably be slightly baffled as to why I had to log in twice, and even more confused to find that no one had been looking at my profile at all.<\/p>\n Meanwhile, the username and password I had entered would\u2019ve been recorded by the scammers and tied to my email address by the tracking ID or the specific URL.<\/p>\n It\u2019s a mistake to think that scammers can\u2019t do much with a LinkedIn ID and password. They can gather details of your professional contacts, your job history, and your education; they can find out your legal name and which company you work for. If they\u2019re lucky, they can gather enough personal information to successfully impersonate you.<\/p>\n If the scammers are really<\/i> lucky, they\u2019ll hit someone who uses the same username and password for multiple online accounts. If this happens, the best possible outcome is that your email account becomes the source of fresh email addresses for more phishing attacks. And the worst? They get access to every platform and site that you\u2019ve used the same credentials for \u2014 whether that\u2019s your Facebook account or online banking app.<\/p>\n Phishing via email is the most common type of attack; it\u2019s super-easy to do and can be carried out at no cost, either by using free-tier VPS, hijacking a mail server, or even someone\u2019s home PC \u2014 but it\u2019s not the only method.<\/p>\n Other phishing attack methods include \u201cvishing\u201d, which involves a phone call from a person pretending to be a trusted institution such as a bank. The criminal will ask you to confirm private details such as your account number, sort code, and card information, often telling you that (ironically) your account has been compromised.\u00a0<\/p>\n Scammers also commonly send phishing text messages, which is known as \u201csmishing\u201d. These text messages usually impersonate reputable organizations such as delivery services, with a link to track your parcel or rearrange your delivery.<\/p>\n Or, they might hit you with a message from someone you trust by hacking their account, such as your family member on Facebook Messenger. Messages almost always include a link for you to click.<\/p> \n Both vishing and smishing employ paid-for network services, as it costs to make a phone call or send a text. But neither are nearly as common as email phishing.<\/p>\n The easiest way for criminals to obtain a list of valid email addresses is to buy them.\u00a0<\/p>\n Different groups of hackers target organizations with a large user base to obtain as much information as possible. LinkedIn isn\u2019t the only platform falling victim to cybercriminal attacks, but their record for upholding data security over the past decade is less than impressive.\u00a0<\/p>\n More than 100 million sets of account details<\/a> were stolen in 2012, followed by a further 500 million in May 2016, and 700 million a mere two months<\/a> later, including \u201cfull names, gender, email addresses, phone numbers, and industry information\u201d.<\/p>\n Scammers can also get hold of your details if they appear in the contacts list of a compromised account \u2014 either personal or business \u2014 or if your email address appears anywhere on the web. My email address is viewable on two of my personal websites, which is, I assume, where it was scraped.<\/p>\n Phone numbers for vishing and smishing attacks are obtained in a similar way. Most people provide their phone numbers whenever they sign up to an online service. When that service is inevitably hacked, phone numbers can be revealed along with the other details. These are then packaged and sold to scammers.<\/p>\n Another way for hackers to target you is by combining common names and last names with numbers and well-known email providers. If your email address is based on this format, there\u2019s a good chance you will be targeted by hackers, even if they have no other information about you; for example, sending out emails to \u2018johnsmith@gmail.com<\/a>\u2019 or \u2018johnsmith2@gmail.com<\/a>\u2019.\u00a0<\/p>\n Email accounts have more value to criminals if they\u2019re active. An easy way for hackers to tell if an account is active is to have an email load trackers from elsewhere on the internet. These trackers can be as simple as an image with a unique code that is matched to an individual recipient.\u00a0<\/p>\n Most emails aren\u2019t just plain text and attached image files; they\u2019re actually HTML pages. As such, they\u2019re able to drag in components from elsewhere on the web and display them in your email inbox. This saves on resources as hefty image files can be hosted on a remote server rather than sent in the email itself.\u00a0<\/p>\n When the images are displayed, a request is sent from your machine to the server, requesting the image file; this action can be logged by the remote server admin. If images in emails are set to load automatically, hackers will know that the account is active as soon as the email is opened, even if no other action is taken. Marketers do this and even your bank does it \u2014 the difference is the email you receive from them is legitimate.\u00a0<\/p>\n Phishing attacks are designed to fool people. If you have fallen victim to one, you shouldn\u2019t feel too bad about it; they\u2019re meant to trick as many people as possible through plausibility, and will either exploit their victims\u2019 curiosity or fears of their own safety.\u00a0<\/p>\n My curiosity was piqued because I wanted to know who had been looking at my non-existent LinkedIn profile. Even though I know full well that I don\u2019t have access to the platform, I almost fell for the hacker\u2019s bait. Another phishing email I received recently told me that an Amazon purchase I had made had been canceled, despite never making a purchase.<\/p> \n This appeals to curiosity \u2014 the recipient wants to know which item has been canceled. And then they\u2019d probably fear that someone has accessed their Amazon account to purchase something. The temptation to feverishly click through can be overwhelming.<\/p>\n Not every email you receive is sent with the intent to trick you into revealing personal information, but it\u2019s a good idea to pretend that they are.<\/p>\n It\u2019s good practice to have image loading turned off by default \u2014 if you accidentally open a phishing email, scammers will know that the account is active. And if you open it while connected to your home WiFi and not connected to a VPN, they\u2019ll know your IP address, too.<\/p>\n The email itself will also contain a number of giveaways, depending on the sophistication of the scammer. If the email is impersonating a well-known company, spelling mistakes in the text are a giveaway.<\/p>\n Other easy-to-spot factors that indicate an email is not from a legitimate sender include:<\/p>\n After reading the text, you should check who the email is really<\/i> from. You can see in the below image that the sender is \u2018Amazon Support\u2019,<\/i> but hovering over the name reveals that the sender\u2019s address has nothing to do with Amazon.<\/p> \n Even if the sender\u2019s email seems legitimate, you should examine any links before you click on them. Hovering over links in the email body will show the true address at the bottom of your browser window. It should match the sender\u2019s supposed source \u2014 links in an email from Amazon, for instance, should appear as an Amazon domain.<\/p> \n You should also be careful of substitutions \u2014 Amazon is not the same as Amaz0n, for example. Scammers can buy second-level domains for a mere few dollars, allowing them to impersonate reputable and trustworthy organizations.<\/p> \n Even if everything within the email appears to check out, you should still exercise caution.<\/p>\n If Amazon, PayPal, LinkedIn, or any other company is sending you notifications, those notifications will be there if you log into your account directly. Open up a new browser tab, type in the address, and see if you can see the notifications when you log in.<\/p>\n Sitting at your desktop computer, spotting scam emails is fairly straightforward. You have a nice big screen on which to inspect formatting and a mouse with which you can hover over links to gain more information without actually clicking on anything.<\/p>\n On phones, you\u2019re very limited as to what information you can easily access and when your mobile is ringing, you have a limited amount of time to decide whether to answer it or not.\u00a0<\/p>\n If the call is from a freephone or unknown number, you should never assume that the caller is who they say they are \u2014 in fact, it\u2019s best practice not to pick up at all. Instead, Google the number and find out who it belongs to. If it\u2019s your bank or energy company, call them back on the number listed on their website.<\/p>\n Remember, just because the number that appears on your screen does <\/i>belong to your bank, it doesn\u2019t mean that it\u2019s really your bank calling you.\u00a0<\/p>\n![\"\"](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2022\/03\/phisherman-1024x683.jpg\")
What is Phishing?<\/h2>\n
How Does Phishing Work?<\/h2>\n
Different Types of Phishing<\/h2>\n
![\"\"](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2022\/03\/image6.png\")
How Do Scammers Get Your Details?<\/h2>\n
Why Do People Fall For Phishing Attacks?<\/h2>\n
![\"\"](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2022\/03\/amazon_phishing_email-1024x535.png\")
How to Avoid Being Caught by Phishing Attacks<\/h2>\n
\n
![\"\"](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2022\/03\/amazon_phishing_email_2.png\")
![\"\"](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2022\/03\/amazon_phishing_email_3.png\")
![\"\"](\"https:\/\/www.privateinternetaccess.com\/blog\/wp-content\/uploads\/2022\/03\/image5-1024x169.png\")
Spotting Vishing and Smishing Scams Isn\u2019t as Easy<\/h2>\n