Translated from Português (Brazil) • View original Phishing Scams and Anti-Phishing Measures – What Users and Service Providers Should Do
Have you ever heard of "Phishing"?" Phishing" is one of the thousands of cybercrimes that we find on the internet. Today I will explain about this scam and show you how to avoid it.
What kind of scam is phishing?
Phishing is a cybercrime where hackers impersonate real organizations, such as a large mailing site or bank, and use fake websites or emails to steal important personal information, such as credit card information and login passwords.
If this information is stolen, it can be misused, impersonating someone, making a large amount of purchases, illegal shipments and the like.
As time goes on, the risk of this phishing scam is increasing as the number of people buying products on the internet grows more and more.
What is a phishing scam?
There are several methods of phishing scams, but email is a typical technique. Some of the most commonly used contact strategies include phrases like:
・"We have introduced new security features." ・"Personal information has been leaked." ・"We have confirmed the access of a third party." ・ Sending a warning email where you are taken to an invalid URL to enter the information. Recently, there are cases where not only emails, but also shopping websites are created and directed to them. Note that most of them are very well made, making fake websites as close as possible to real websites, where they often have the exact same structure.
When buying something on the internet, be sure to check the URL of the website carefully to make sure it's safe before entering the information.
What should I do to avoid phishing? (User side)
To avoid phishing scams, keep the following in mind when making purchases or entering personal information on the internet:
(1) Access the correct URL
・ Check the sender of the email to see if they are suspicious. ・ Check if the destination URL is not suspicious or if it really exists. Remember not to click on the URL described in the email. ・ Check if you are accessing a different page than usual.
(2) Be careful of fake emails
・ If you receive a suspicious email, please check the service content on the real website.
(3) Check the security of your device (PC, mobile, etc.)
・ Keep software up to date. ・ Actively utilize the security functions of service providers (two-factor authentication, security software, etc.).
You can also take anti-phishing measures, so keep the above points in mind.
What should I do to avoid phishing? (Service provider side)
Obviously, user-side measures are necessary.
However, if a fake email or website is created and a victim appears, it can lead to a reliability issue and deterioration of credibility on the service provider's side, so it is necessary for the service provider's side to take action as well.
"Mamoru PUSH" is a recommended solution as a countermeasure against phishing.
Why is "Mamoru PUSH" strong at phishing? Let's talk about three main points:
Point 1: Block unauthorized access with the standby function!
You won't receive push notifications unless you give permission in the smartphone app before logging in.
Therefore, even if a malicious third party obtains an ID/password through phishing, all access can be blocked. Only a person with legitimate login information needs to log in with a clear intention.
It is also effective as a countermeasure against restore attacks, which attempt to log in to websites listing illegally obtained IDs and passwords.
Point 2: Detect unknown threats!
If the access is from an environment where you have never previously logged in, a warning will be displayed. Only after accepting the warning will the normal approval screen be displayed. When the login is approved, two types of highly encrypted tokens are generated in the background and combined.
Point 3: Supports phishing scams that can't be avoided with one-time passwords
There is a way to authenticate with a password that can only be used once (one-time password), but recent phishing scams are increasing the number of ways to breach one-time passwords. One-time passwords are not a good anti-phishing measure. Because of this, the introduction of two-factor authentication is effective as a defensive measure against phishing.
Mamoru PUSH is a two-factor authentication using ID and terminal.
Even if the user enters an ID/password on a fake website and a hacker tries to log in to the real website, based on this information, a warning message is displayed on the user's terminal when an authentication request is issued from an environment that has never been authenticated.
In the unlikely event that you enter information into a phishing website and allow unauthorized access, you can block unauthorized access remotely when the user notices.
Mamoru PUSH is a passwordless authentication that has been designed to be easy to use, not only for service providers, but also for users. Mamoru PUSH - idealized, also, by anti-phishing measures!
Colorkrew, which has been providing billing and authentication services for more than 10 years, offers highly satisfactory authentication services with reliable operational results and expertise.
Request a presentation for your business. Our team is ready. Let's go on this journey together. Daniel Alves (11) 97632-1226 daniel.alves@colorkrew.com Colorkrew | Move on
PS.: Schedule a presentation and be surprised.
Translated from the original post – https://mamoru-secure.com/security_articles_18.php?source=biz_en