Main Menu

Search

Try searching for

Identity theft

Social security protection

Credit monitoring

Reputation management

Blog > Internet Scams > How They Do It: Spearphishing Scammers at Work
 May 25, 2021

How They Do It: Spearphishing Scammers at Work

Smiling man holding a fishing pole next to a river.

5 warning signs you’re about to get hooked

How’s your firewall? Got those spam filters engaged? An alarming percentage of individuals still fall for spearphishing attacks—either at home or work—even with spam prevention in place. Unfortunately, these numbers are on the rise. Coronavirus-themed attacks have become prevalent, but others are run-of-the-mill plans tapping into age-old themes like lost friends or desperate relatives. Learn all you can to understand how these would-be thieves bait their hooks.

Like many scams, phishing is on the rise. Some researchers peg the success rate at well over 10%. Others predict it’s over 30%—a genuinely frightening number. One recent report indicates that more than 1 in 5 data breaches also begins with one of these successful lures.

In all, three different contact paths deliver the bait. Phone calls (vishing), texts (smishing), and emails (the original group attacks) each can be immensely powerful. One approach has risen to the top of the heap in effectiveness and it’s the toughest to prevent.

What is spearphishing?

Spearphishers have proved so successful that they’ve become all too common. Unlike phishing, which launches waves of emails or texts to solicit clicks, spear targeting aims at a finely selected individual instead. It seeks to establish an emotional connection with the victim. It’s all designed to prompt you to click on bogus links. Goals vary, but some successful attacks distribute malware while others seek personal data. Scammers are adept at mimicking the appearance of a legitimate company’s website.

All the big banks, including Wells Fargo, Chase and U.S. Bank, are targets because the odds are good that you’re a customer at one of them. Phishing emails can convincingly duplicate a bank’s home page in the hope that they’ll trick you into logging in.

Many times, scammers craft their communication to resemble a bank alert stating a compromise occurred with your account. An actual attack on your balance will begin immediately if you bite this hook and enter your login credentials.

Spearphishing betters the odds

Spearphishing is the evolved sibling of phishing and it’s rapidly surpassing the original concept in efficacy. Spearphishing—picture a spear gun in your mind—aims at a much smaller target. Instead of phishing attempts sent to thousands in bulk attempts, this method singles out one person or just a handful. Some experts state that one in three goes to a solo recipient. When it works, experts estimate the average spearphishing loss exceeds $1.5 million!

How would you react to emails that appear to be from the company finance director, your CEO or a colleague? What about a text from a CEO impersonator claiming she lost her wallet and needs $2500 wired to her ASAP?

These requests strongly resemble legit corporate communications. Spearphishing is wildly successful because it is so personalized. The more specific the data, the greater the odds of click-through. So how do scammers gather the details?

First, hackers have mastered social engineering—the art of gleaning critical information on potential victims. They might search social media, speak to neighbors or look up your property records online. Personal details—name, address, recent awards and more—are harvested from these sources and corporate web pages, then sprinkled into texts and emails to boost the sender’s credibility. You’re far more susceptible if the interaction utilizes data familiar to you.

Corporate financial offices and human resource departments are top spearphishing targets. Each spring, scammers target these offices sending what appears to be a CEO request for all employee W-2 tax forms. The result is bogus income tax returns that can grab legit refund checks.

Top 5 warning indicators

Don’t be the employee who’s duped into wiring company money to a scammer. Don’t surrender your login credentials without a fight. Look for these top 5 indicators which indicate a scam in progress.

  • Unexpected communications addressed to you personally from a lender, bank, or any other business.
  • Urgent monetary need due to a lost airplane ticket or wallet is a big red flag.
  • Any and all requests to wire money ASAP are suspicious, as are sudden changes in email from a firm that bills your company regularly.
  • Contact from an organization you don’t communicate with routinely.
  • Odd email addresses that display when you hover your cursor over them.

Look at some wacky examples we detected recently. Emails from @fatherslap.co.uk, @casinomator.com, one claiming to be from Apple sent by @esadboy.com and @e-startupindia.com were easy ones to reveal. But the fraud isn’t always this obvious. Some blend a famous corporate name into documents and the result is something such as @e.chase.service.com. These require more investigation.

Shield yourself

Con artists also impersonate IRS, Social Security Administration, non-profit groups, Homeland Security and Dept. of Health and Human Services officials in spearphishing. Most of these government websites and financial agencies feature links on their homepages to share any questionable emails with officials. You can also alert the Better Business Bureau in your area and AARP’s scam division.

  • Ask a friend, coworker or relative to check strange email with you. Phishing buddies are the best kind!
  • Don’t click links you don’t recognize.
  • View any emails from unknown sources as suspicious. Hover the computer mouse cursor over each and every embedded link to see where they’ll take you. This is vital. Haste is the enemy so take your time.

One final thought. Most of the personally identifiable data spearphishers need for success is information you should protect and monitor frequently. IDShield searches for leaked data routinely and offers alerts to tip you off when stray information turns up that could cause harm if misused.

IDShield is a product of Pre-Paid Legal Services, Inc. d/b/a LegalShield (“LegalShield”). LegalShield provides access to identity theft protection and restoration services. For complete terms, coverage, and conditions, please see an identity theft plan. All Licensed Private Investigators are licensed in the state of Oklahoma. This is meant to provide general information and is not intended to provide legal advice, render an opinion, or provide any specific recommendations.

ESS

Related Post

Traveling woman in an airport wearing a backpack and looking at her cell phone to avoid a travel scam.

How to Spot and Avoid Travel Scams

Originally published March 3, 2021. Blog post updated for accuracy, comprehensiveness and freshness on June 27, 2024. As travel season peaks, fraudsters ramp up their efforts to deceive unsuspecting travelers. Being informed, proactive, and vigilant are ways to...

View from behind of a large wedding party outside in a garden by a fountain while a photo is being taken. Shows cybersecurity wedding success.

Cybersecurity Tips for Wedding Success

The big day is on the way! You’ve been planning your wedding with love and care, and finally all your hard work is about to pay off. Or perhaps you are a wedding guest, prepared to attend this exciting event. Whether you are a member of the bridal party or a...

Man looking at a woman's photo on his phone via a dating app

Avoid These Common Romance Scams

It’s a universal truth that most people want to find love. The problem is, online fraudsters use that desire against unsuspecting, vulnerable people on dating apps and dating sites. Not to burst Cupid’s bubble, but dating and romance scams are blooming like love in...