Trust and Safety Tuesdays: Phishing

With the advances in technology and the increase in IA, it is imperative that you remain aware and informed about trends in scams and frauds. Practicing good security habits for online accounts is more important than ever to ensure the protection of information and private assets. To help keep the community informed, the Trust & Safety Tuesdays theme that is being addressed today is one of the most subtle methods used to cheat and cheat: Phishing.

What's Phishing? Phishing is an attempt to acquire personal information by going through a legitimate business, usually with e-mails or direct messages disguised as this business. The purpose of phishing is to obtain personal information, such as bank data, specific account information on platforms, such as logins, or other personal details. This is often done by pretending to be a respectable source to trick the victim into providing this information under the pretext of legitimate business concerns.

Once obtained, this information can be used for various forms of fraud, including credit card purchases, account appropriation and even identity theft. With the possibility of severe damage like that, it's crucial address these cases quickly and accurately.

How to Identify Phishing

Phishing attempts usually present themselves in the form of emails, text messages, social media messages, or phone calls.

Although these individuals are disguised as a reliable source, there are often revealing signs of phishing that can be observed:

• Emergency Sense: The message used in phishing attempts often depicts a sense of urgency in the request. For example, they may make claims that an important account is about to be closed immediately unless payment information is provided. Another example is a message that indicates that a person can face fines or legal repercussions if he does not meet a payment demand.
• Personal Information Requests: Phishing attempts often include unexpected requests for personal and/or financial information, often disguised as a request to confirm information from an account that you own with a company or platform.
• Suspected Links: Phishing attempts often include links to external sites that request your login information. Links are usually hidden inside clickable buttons or are made to look like a legitimate link at first sight. Sometimes links can even lead to a web page that looks like the one you might be familiar with.

This is done to trick people into using their logins on an external site controlled by fraudsters, without realizing that something is wrong until later.

Common strategies include:

• Use buttons like “Login Here” or “Home Page” to hide links;
• Embed fake links into a real link by changing hyperlink;
• Use swapped characters to imitate the real link, such as capital “i/I” to replace the tiny “l/L” in words like “marketplace/marketpIace”.

How to Protect Yourself

Keeping yourself informed and up to date about phishing attempts is the best way to ensure that personal information is not provided to an unreliable source. This also includes thinking of ways to test whether a message or connection is an attempt at phishing.

Think Before Clicking: An important consideration is that fraudsters often pass for widely used brands, such as a large social media platform, a delivery service or a financial institution. This is because contact is less likely to stand out if the person already uses the service.

Think if the message is relevant to you: This may seem to stop to think if you actually made any request recently before clicking on the link that says, “Your package has an update.” When asked to provide personal information, one should consider why someone is asking and if that is abnormal for that service or platform. This includes thinking about the level of urgency emphasized and the level of detail shared in the message.

Checking Hyperlinks: Sometimes links are sent as hyperlinks, where the link is hidden in a string of characters.

On some platforms and websites, you can pass the mouse cursor over the hyperlink, and it will show you the full link. You can also right click on the hyperlinked text, copy the link and paste it into a new anonymous or private navigation tab in the browser to see where the link actually leads. Remember, the link can take you to a login page that looks very similar to the login page of the company you are trying to imitate. In such cases, it is best to access the site on your own, with the link that is known to be the correct one.

Second Life Viewer also has a feature to show official Second Life links from secondlife.com sites. Verified links to these sites will have Second Life's hand logo next to the message, to show that the link is a secure and verified Second Life link.

Protecting Your Information

If it is found that you clicked on a phishing link and may have had your personal information compromised, it is essential to protect your accounts and information as soon as possible. Make sure you reset any account passwords that may have had the information compromised.

Add multiple factor authentication to accounts, update security question information, and ensure that connected emails are up-to-date and secure as well. If any financial information is compromised, it is important to contact the affected financial institutions to ensure that the accounts and information remain secure.

Keep your information safe! Getting acquainted with the characteristic signs of phishing is crucial to protect your personal and private information.

These methods are always evolving, therefore, it is also essential to carry out your own research on current trends of fraud and coups, how to identify them and how to protect yourself so as not to become a victim of these attempts. If there are further questions about phishing attempts and how to protect accounts, we recommend participating in the next Trust and Security User Group meeting on July 21 at 11:00 AM SLT. More information about this meeting and other meetings of the User Group can be found Here..