Half of All Phishing Emails are After Your Money

Kaspersky Labs has released some interesting numbers regarding phishing in 2016.  According to them, nearly 50% of the phishing attacks that were registered in that year were designed and executed specifically to steal money from victims. That’s an increase of 13.14% over the previous year. Phishing for financial information and data related to it were the highest share of phishing attacks Kaspersky has ever seen.

In 2016, the company’s data found that nearly 155 million user attempts were visits to various phishing pages. Just over 47% were financial related. In other words, they were specifically executed to retrieve banking account numbers, payment card details, social security numbers, and/or online banking credentials.

Phishing for this type of information works. That’s because it doesn’t take any special skills or technical prowess to pull off. All it does take is for someone be convinced to click a malicious link or attachment in email and enter in the information requested. Another possibility is for a user to just land on a malicious web page where malware gets downloaded to a device and grabs the information for the cyberthief.

While it’s easy to get caught up in day-to-day activities, these criminals count on everyone being too busy to pay attention to what the email messages say or how they look. The average employee receives anywhere from 50-150 email messages per day. Some of the phishing ones get filtered out, but others are crafted well enough to bypass filtering tools. Those are the ones that need extra attention. If the message is from an unknown sender, or has a link or attachment that is unexpected, it should be met with suspicion. Those require a bit more scrutiny before any action is taken. If there is any doubt that it may not be a real one, just delete it. If you feel like it might be OK, double check with the sender first by calling him or her on the phone, texting, or walking to his or her desk or office.

When it comes to a request for sensitive information, such as W-2 information, there should always be a process in place for someone else to confirm that need. Consider who the sender is and whether or not it’s likely he or she needs the information. If the CEO is asking for W-2s, it should be questioned. Most executives don’t need that information. So, always question those types of requests and have multiple people approve them as well as wire transfers and other financial requests.

There was other interesting information in the Kaspersky report. Scammers tend to use the same brands year after year to trick victims. Those include popular shopping and auction sites, multinational financial institutions, and payment systems such as PayPal. In fact, payment systems and retail accounted for 11.55% and 10.14% of attacks respectively.

And for Mac OS fans, those users were victims too at a rate of 31.38%. This just shows that phishing doesn’t discriminate and it doesn’t take a malware attack to succeed either. While malware targeting Windows and Android still leads the way, phishing works by convincing OSX and iOS users to click malicious links and attachments in the same way it works on Windows and Android users.