Understanding the proclivities of the 2014 FIFA World Cup fans gives criminals an advantage. The World Cup provides a window of opportunity and a tremendous vehicle for online fraud such as phishing. Not only do the targets accept that they will receive a barrage of World Cup-related solicitations, but they often desire said solicitations and are excited to “click”.
Picture: Getty Images
This “perfect storm” isn’t specific to the World Cup. Phishing scams are often associated with current events such as:
- Entertainment in the form of movie trailers, awards and celebrity photos
- Sporting events with large, preferably global audiences
- Natural disasters, political elections and military actions
- Viral videos of animals seeing themselves in mirrors
[related title=”WORLD CUP” tag=”fifa-2014″ items=”2″]Unfortunately for the targets of phishing, the fraudsters have nefarious ulterior motives. The fraudsters may be interested in identity theft, stealing credentials, stealing financial information, locking your system and holding it for ransom, or adding your device to their botnet army to be controlled at will. The results of phishing can impact individuals and organisations. The impact can be felt in a number of ways including depleted bank accounts, credit debt, sensitive/personal data theft, countless hours of negation with financial institutions, embarrassment, stress–the list goes on.
The risks to the criminals are low. This is because the likelihood of being apprehended and the severity of the punishment for phishing, and most cybercrimes depending on country, are low. Thus legal deterrence is ineffective.
Phishing Safeguards
While there is no anti-phishing panacea that will mitigate all threats, there are technical and non-technical controls that can reduce the risk of a phishing attack being successful. Here are 15 safeguards to consider:
- Verify before you click, download and open
- Use bookmarks instead of clicking on a link, or typing in a URL with potential misspellings; that URL could take you to a malicious site
- Don’t respond to emails with sensitive data
- Don’t enter sensitive data it into a form indiscriminately
- Don’t enter sensitive data into pop-up windows
- Understand criminal tactics and if in doubt pick up the phone – criminals will try to create a compelling event such as
- Enter your password or all your cloud data will be corrupted
- Click here to avoid your Internet service being disconnected
- Final warning – download this anti-malware tool to avoid shutdown
- You have five seconds to comply or your bank account will be frozen
- Your smartphones and tablets are computers too and the security best practices you apply to traditional computers like laptops should apply to them
- Keep your operating systems and applications patched and up-to-date
- Use web filtering software to disallow access to known bad sites — many are free
- Use browser phishing protection — common in most modern browsers
- Install and update endpoint security controls
- All legitimate websites requesting personal information such as your bank should be encrypting communications — look for “HTTPS” and or the lock icon in the browser’s URL field
- Keep an eye on your account activity — many sites provide last login date, location, and so on
- Use credit activity monitoring services
- Report suspicious activity and opt in to share threat intelligence via your security solutions — use the crowd as a force multiplier
With events like the World Cup where information is flooding our laptops, tablets and smartphones from all directions, it is important not to get so caught up in the moment and forget the criminals are working overtime.
By considering these 15 safeguards and successfully mitigating phishing attacks, you’re negatively impacting the criminal revenue stream and making this type of fraud less appealing.
Brian Contos is senior vice president and chief information security officer for Blue Coat. Follow him on Twitter @BrianContos.
Comments