How to tell if an email is trustworthy 👨‍💻👍

Did you know that the main cause of security breaches is phishing? Hackers often impersonate other people or trusted organisations, send redirect links, and the ingenious methods they use are always being improved.

On top of that, this fraudulent method is only one of those that use email for fraud. Businesses need to be able to tell whether an email address can be trusted before they take any action.

Microsoft alone catches billions of phishing attempts every year. In 2018, the company founded by Bill Gates blocked five billion fraudulent emails through Threat Protection Services. The company is, then, having considerable success when it comes to cybersecurity, and phishing attacks in particular.

Anyone carrying out one of these attacks has a huge amount of work discovering new techniques that let them escape detection. Analysing the latest available data, Microsoft filtered attack attempts across several legitimate cloud services, including Amazon, Google, Microsoft Office365, Microsoft Azure and others.

The technology giant is even creating a process that identifies and immediately neutralises phishing attempts without any impact on the performance of legitimate applications. Phishing specialists hide links, scripts and, in many cases, malicious software, with mutations in the code, behind legitimate Microsoft files to avoid being detected.

By using legitimate code and disguised links in Trojans, hackers can launch highly effective phishing campaigns, something they did very systematically in 2019 and continue to do this year. Cybercriminals have been working on mutating legitimate code and applications for several years already, in an attempt to extract data from companies and government bodies worldwide.

Office 365 is the attackers' Trojan of choice, followed closely by dozens of cybersecurity companies that have seen hackers try to impersonate their products. Among others, there are well-known names such as Kaspersky, LastPass, Microsoft, BitDefender, Citrix, Comodo, Imperva and CyberRoam.

Using Trojans to steal search data

Last year, Microsoft discovered a sophisticated phishing attack that combined impersonation, redirection and social engineering methods. And what did this attack consist of? It was based on using links to Google search results, presented as normal but which were in fact Trojans, created so that victims would end up on pages controlled by the attackers.

Microsoft found that the sophisticated attack was a traffic generator that made sure pages would be redirected according to specific keywords. Through this scheme, cybercriminals tried to send fraudulent emails that rested on legitimate URLs, using the Trojans with legitimate domains too to win the trust of the people receiving the mail.

Knowing which emails to trust or not is a cornerstone for ending or reducing the fraud committed through these phishing attacks.

How to fight these sophisticated attacks

Meanwhile, email addresses can be a valuable source of information that businesses can use to prevent digital fraud. Blind trust in every message received can have truly devastating effects.

Companies such as Kount can help avoid this damage. With a digital calculator, it is possible to identify an email address's trust level in just a few milliseconds; attacks and fraud can be blocked and the user experience can still be improved.

This organisation has been researching new ways to develop the ability to assess how reliable an email address is. That development is done, in large part, using artificial intelligence.

How to avoid the attacks

One of the attackers' favourite tactics is to create as many email addresses as possible, because they need to impersonate real companies and deceive the victims. Kount found that, if it can identify the age of an email address, it can more easily and effectively determine how reliable it is.

For the rest of 2020, phishing attempts will continue to increase, based on legitimate code, links and executable files sent in Trojans to avoid detection. The targets of the attacks will also become more and more specific.

To avoid the attacks, you should first pay attention to the sender. Banks, government bodies or utility companies do not send emails making collections, asking you to change your password or asking you to provide other data. Look at what appears after the “@” sign. Attackers usually use the same name as the organisation they are impersonating but add words such as “cobrança” (billing) or “info”. For example: cliente@edp.cobrança.pt

Watch the links too: many of them are not exactly what they appear to be. Check the URL you will be redirected to before you click. You can do that by hovering the mouse over the link, because that way you will see the real address. If any of these links ends in “.exe” or “.src”, be careful! It is a malicious file that will be installed on your computer.

You also need to be very careful with attachments: if you receive an unsolicited email, do not open any of the attached files.