In this article, we are going to look at a phishing e-mail to see what makes it work.
Read the message below, and substitute the fields *Your Boss* and *Your Company*, with the actual name and company of your boss.
How would you feel if this landed in your inbox?
Chances are you would feel pretty uncomfortable receiving an e-mail like this. Your heart starts pounding, your face turns red, and you’re looking around to see if anyone else has noticed. The last thing you want is for rumours to start spreading about you in the workplace.
But what is it about this phishing e-mail that has that effect?
What triggers this kind of emotional response?
Four common triggers
The email above contains four common triggers: hurry, curiosity, deference to authority, and the fear of consequences. Let’s take a quick look at why scammers love pushing these buttons, and how they affect us.
Trigger 1: Hurry
If you have time to think, you probably won’t click. The more time you have to think about the content of the phishing e-mail, the more likely you are to discover the scam. That’s why you’ll often see short deadlines and text that conveys a sense of urgency in phishing e-mails, because the scammers want to rush you into making a bad decision.
Trigger 2: Deference to authority
When the boss says “JUMP!”, you jump. That’s usually how people react. After all, your boss decides your opportunities for advancement, your salary, and ultimately if you continue to stay employed or not. The ‘do as your boss tells you’ automatic response is therefore well ingrained in most adults. So, when a phishing e-mail from ‘your boss’ lands in your inbox, your natural instinct is to comply with their demands.
Trigger 3: Curiosity
This is a common trigger in both spam and phishing e-mails. The mind hates unanswered questions, so if the e-mail promises that the answers are at the other end of clicking the link, the temptation to follow through is high. Especially if there is either a reward for doing so, or a penalty for not clicking.
Trigger 4: The fear of consequences
In the phishing e-mail we just looked at, the penalty for not clicking is stated as; “We will be forced to reconsider your employment with us”, which sounds quite terrifying.
After all, nobody wants to get fired. Getting fired means you lose your income, and your ability to support yourself. It could also make it more difficult to get hired elsewhere.
“Why did you leave your last job?”, is a common interview question. And if they ask for references from your previous employer…
Well, it doesn’t look good.
Add to that the effect that getting fired has on your social standing and reputation, and you can see why phishing e-mails like these are so effective.
Next, let’s look at how the scammer cuts off the victims’ support options.
Cutting of communication and support
If you take a look at the subject line, you’ll see that it contains the word ‘CONFIDENTIAL’. This is how the scammer instructs the victim to keep it to themselves. And in the e-mail body, we see this repeated in the line; “Since this is a confidential matter, all materials are protected and available only to you”.
This will discourage most recipients from talking about the e-mail with colleagues, which could increase the chances of the scam being discovered.
Next, they cut off the victims’ ability to confirm whether the message is genuine or not.
The ‘boss’ writes: “Please do not call or contact me”, which of course is the first thing you should do. Whenever you are unsure about a message, seek confirmation from the (supposed) source. Call them on their registered phone number, or (if they are in the same office building) stop by their office for a quick chat.
Unfortunately, in a case like this, the recipient may avoid contacting their boss out of fear. Thinking they’re in enough trouble as it is, the last thing they want is to antagonise the boss any further.
Two warning signs that got overlooked
One thing you should always check with every e-mail that you get: the address in the ‘from’ field.
In the case we just reviewed, the message did not originate inside the company, and checking the from field quickly reveals that this is a phishing attempt. But, if the sender address is spoofed, it will appear as if it’s coming from your own company domain. Which is why checking the from field is the first thing you do, but not the only.
The second warning sign, is the generic greeting in the opening line. “Dear colleague” would be a perfectly good opener for an invitation to the office Christmas party, but for a sensitive matter you’d expect the boss to call you by your name.
One simple rule that could stop this attack
Rule: Never send out e-mails with login links.
Make sure you have clear rules for how you communicate inside the company as well as with external collaborators and clients. Use mandatory policy training to educate your employees about these rules. If you do, attacks like these are less likely to succeed.
A final note: The role of expectations in phishing
Phishing e-mails exploit our tendency to see what we expect to see, instead of what is really there.
Getting an e-mail from the boss, the bank or insurance company for example, is not uncommon. Scammers are aware of this, so they send out thousands of e-mails posing as a well known bank or insurance company, with subject lines like “About your car loan” or “About your insurance claim”, knowing that people are waiting for messages like these.
And when the recipients see a phishing e-mail with these subject lines, they assume that it’s from a trusted source.
To keep yourself safe, always assume the opposite.
