From the Iowa Department of Revenue
Skilled hackers use information gathered through social media where personal information is displayed to the public such as LinkedIn, Facebook, and Twitter. This week’s message is about how you can protect yourself from phishing attempts to steal your information.
- Take your time. If a message states that you must act immediately or lose access, do not comply. Phishing attempts frequently threaten a loss of service unless you do something. Cybercriminals want you to react without thinking; an urgent call to action makes you more likely to cooperate.
- Don’t click links in suspicious messages. If you don’t trust the e-mail (or text message), don’t trust the links in it either. Beware of links that are hidden by URL shorteners or text like “Click Here.” They may link to a phishing site or a form designed to steal your username and password.
- Check the sender. Check the sender’s e-mail address. Any correspondence from an organization should come from an organizational email address. A notice from your college or university is unlikely to come from YourIThelpdesk@yahoo.com
- Confirm identities. Phishing messages can look official. Cybercriminals steal organization and company identities, including logos and URLs that are close to the links they’re trying to imitate. There’s nothing to stop them from impersonating schools, financial institutions, retailers, and a wide range of other service providers.
- Beware of attachments. E-mail attachments are the most common target for malicious software. When you get a message with an attachment, delete it—unless you are expecting it and are absolutely certain it is legitimate.
- Protect your credentials. No legitimate company or organization will ask for your username and password or other personal information via email. Your bank definitely won’t.
- Limit what you share online. The less you share about yourself, the smaller the target you are for a phishing attack. Cybercriminals use information you post online to learn how to gain your trust.
- Trust your instincts. If you get a suspicious message that claims to be from an agency or service provider, use your browser to manually locate the organization online and contact them via their website, e-mail, or telephone number.
Play hard to get with strangers
Just remember, cybercriminals use many different phishing tactics, hoping to fool their victims. If you’re unsure who an email is from (even if the details appear accurate) or if the email looks “phishy,” do not respond and do not click on any links or attachments found in that email. When available use the “junk” or “block” option to no longer receive messages from a particular sender. Read the Phishing Cybersecurity Tip Sheet for more information