Middle Managers Too Rushed to Check for Phishing Messages

We have all heard the proverb, “patience is a virtue,” and that is also true when, in the course of regular business tasks, we are scanning through our overstuffed email in-boxes. A report by the security solutions provider, Proofpoint found that as we are juggling all our day-to-day work activities, we tend to become victims of phishers more often when we hurry to get through all the messages. The largest group that fall prey to the scams are the middle managers.

According to the study, middle managers clicked links or opened malicious attachments twice as many times in 2014 as in 2013, making them an attractive target. The researchers speculate that one of the reasons for this may just be that these people are in such a rush to get through their emails, they don’t take the time to determine if they are might be malware.

The average worker gets approximately 40 email messages per day; but middle managers get between 100 and 200. The people who get that many have double or triple the click-through rates.

If you are in middle management (and even if you aren't), slow down a little bit. Spend an extra few seconds to determine if a message is phishing for information. Look for the obvious signs:

• Your Spidey sense tells you that something is fishy about the message. Don’t underestimate this feeling.

• The sender is unknown and the subject line doesn’t quite make sense.

• If you let the mouse hover over the URL, the address is garbage or doesn’t go where you expect it to.

• There are typos, grammatical errors, and an improper use of the language in the text of the message. 

• If the sender is someone you know, but you still are not sure it’s a legitimate link or attachment, pick up the phone and call the person to verify first.

Targeting recipients for phishing is not new. In this study, the results showed that criminals are actually making stealing information a strategized business. They are choosing the time of day to send the bait, which turned out to be Tuesday mornings. There were 17% more clicks at that time. In addition, they are using fake voicemail message attachments marked as urgent, and exploiting company IT departments by constructing messages that appear as if they came from systems administrators.

Those who seem to fall prey to phishing the most (50-80%) are in finance, sales, and procurement. These targets typically have access to payments, fund transfers, and other financial information that is what most of the enterprise phishers are after.

So take some time to breathe before blindly opening attachments or clicking links, even if your TPS reports are due. If it helps to avoid unleashing malware in the network, it’s worth it.