• Skip to main content
  • Skip to primary sidebar
  • Skip to footer
MENUMENU
  • Home
  • About Us
    • Our Philosophy
    • Choosing a Financial Planner
    • Legal and Regulatory
    • Team
    • Careers
    • Awards & Recognition
    • Contact Us
  • Our Services
    • Financial Planning
    • Ongoing Financial Guidance
    • Portfolio Management
  • Financial Planning Basics
    • Continuing Care Retirement Communities (CCRCs)
    • Retirement Planning and Cash Flow
    • Social Security
    • Taxes
    • Insurance & Risk Management
    • Investments
    • 401(k)
    • Real Estate
    • College
    • Liquidity
    • Divorce
    • Estate Planning
    • Sensible Updates
  • Resources
    • Blog
    • Financial Planning for Older Adults
    • Webinars
    • Videos
    • Financial Planning Guidebook
    • Continuing Care Retirement Communities Guidebook
    • Primers
    • Financial Planning Links
    • Client Login
  • Contact Us
Sensible Financial Planning

Sensible Financial Planning

Follow Us

  • Facebook
  • LinkedIn
  • Twitter
Client Login

Call Us Today
781-642-0890

Cybersecurity: Phishing for Beginners*

by
Chuck Luce
Chief Compliance Officer and Head of Business Operations

October 26, 2022

Last year on vacation I took a fishing charter with my family. The boat’s sonar showed us there were many fish in the sea below. We trolled the waters around Grand Cayman, pulling bright and shiny lures that looked like squid to the fish we were after. The trip was mildly successful – we caught one large barracuda — enough to satisfy our fishing hopes for the day and snap some photos.  

Cybersecurity professionals call one of the most common cyber threats “phishing.” If you are not familiar with the term, I’m hoping my family’s recent vacation experience will help bring it to life.

The bad guys who phish behave much as my family and I did on the boat. They are not trying to hook a specific person (fish). These individuals (or organizations) are throwing out lures (emails) into a large body of water (the Internet) hoping a fish (you) will bite.

Phishing campaigns somewhat randomly send thousands (or even millions!) of emails.

The campaigns succeed by catching only a few fish. They lure the recipients to:

  1. Open the email
  2. Engage with the email by clicking links, responding to the email, or downloading attachments
  3. Divulge personal or financial information or send money 

Please note that while this article refers to phishing emails, the information and discussed here can apply to text messages also. I personally get more and more phishing messages via text. Don’t let your guard down just because a message is on your phone.   

Real life examples of phishing and their possible outcomes: 

  1. Basic information request: This phishing campaign seeks sensitive information. Even if they do not get the desired information, any reply may signal they have a “live one” on their line. An information request phishing email may look something like this one I received to my personal email account:  

You will notice the scammer did not mention my name, referring to me as Package Owner.  Phishing is not targeted to an individual (likely thousands of others received this same email), so they use a generic greeting to address the email recipient. 

Had I responded to this email with my address and phone number, the scammers would then be armed with information to attack me with a more sophisticated scheme. Perhaps they would call me and ask for my credit card number so I could pay for the shipping of my $2.5M ATM VISA CARD. 

2. Lucrative prize opportunity: Phishing campaigns often send emails that appear to be from sources you recognize. These emails may have familiar logos and look legitimate. Here is one that my email SPAM filter missed: 

In this scenario, the scammer is attempting to hook me by saying I can win a Yeti backpack cooler if I click the link in the email. However, the link would likely bring me to a fake website. There, they’d  ask me for personal information or steal my login credentials which they can sell on the dark web, use to buy things, or try to login to the financial institutions I work with.  

3. Download ransomware or other malicious programs to your computer or network: These are very common attacks. The crook sends out emails that include a malicious attachment (or a link) that downloads malware on to your computer and can infect a whole network at a company. 

In this example the scammers attached a malicious file to the email. Had I opened that attachment thinking it was a voicemail, it might have infected my computer (if our anti-malware technology did not recognize it as malware). This phishing campaign was a bit more sophisticated than the other examples and may have crossed into the social engineering realm. The crooks customized the sender to look like it was an automated message from within Sensible’s systems (notice the spoofed from email address is Sensible Financial I Voicemail).  

How does Sensible protect itself and our clients’ information from hackers? 

  • Culture: Throughout this series of cybersecurity articles, you will hear us refer to Sensible Financial’s cybersecurity culture. As a group, we talk regularly about cybersecurity and potential threats. During our weekly meetings, we review new phishing campaigns we’ve encountered. When one of us receives a new type of phishing email, we share a screenshot with the whole firm. We encourage everyone to take the extra steps and time to ensure an email is safe before moving forward, even when this slows down our processes. 
  • Training: Anyone who has just joined Sensible Financial will tell you the first meeting they have with compliance is all about phishing and social engineering. Making this the first topic in a series of compliance and risk meetings for new Sensible people bolsters our cybersecurity and reinforces its importance. 
  • Testing: Sensible recently ran our own mock-phishing campaign. The mock campaign created a sense of friendly competition and (we hope) kept our people engaged in our cybersecurity initiatives. It also kept us talking about these threats and further strengthened the culture. 
  • Technology: Culture, training, and testing are important pieces in our cybersecurity program. However, there is a human aspect to all these pieces, and humans are not perfect. Technology is not perfect either. However, it certainly reduces the chances of human error. Therefore, we employ advanced email filtering technologies that capture and quarantine a very large percentage of the phishing emails we receive. Additionally, when a Sensible professional clicks a link in an email, the technology analyzes it before allowing the link to open. The software will not allow any links it identifies as unsafe to open. 

How can you protect yourself from phishing emails and texts? 

  • Scrutinize, scrutinize, scrutinize: Never respond to, or engage with, emails requesting sensitive  information. Take special care with emails from people or companies you are not familiar with and emails asking you to reset your password, or login from a link. Never click links, or download attachments, from senders you do not trust 100%.  If you are unsure a link is authentic, bypass the email and type the company’s website into your browser 
  • Learn to spot phishing : Any email asking for personal information is a red flag. Additionally, emails addressing you as sir, madame, customer, client, etc. are questionable. In an upcoming social engineering article, you will learn how to examine more sophisticated emails addressing you by name. Emails with misspellings, odd language, and company logos that are a bit off are also red flags. Watch out for unsolicited requests to reset your password as well.   
  • Take advantage of standard technology: You are most definitely already under daily attacks from phishing campaigns. If you have not seen many in your inbox, it’s likely because your email provider has automatically filtered them. Providers like Gmail have preset SPAM filtering technology applied to your account. You can report phishing emails that sneak past these filters as SPAM to your provider. Over time, the provider’s software learns about the SPAM you receive and catches more phishing emails.    
  • Research advanced technology: Companies like Sensible employ sophisticated email and malware protection. You can also purchase software to use for your personal accounts and devices. Webroot, Norton, Bitdefender, and Malwarebytes (among others) are well known and have affordable internet security and antivirus packages for corporations and individuals. 
  • Be proactive:  
  1. Consider freezing your credit reports at the three credit agencies, Experian, TransUnion, and Equifax. You can do this online. You will need to create a login account at each agency. If you  want to apply for a loan in the future, you simply login and unfreeze your credit until the lender is finished running your credit. Then re-freeze. 
  1. Use a reputable password manager to create strong passwords and change passwords that may have been compromised. 
  1. Review your financial transactions often. You can set up automatic alerts from your financial institutions to notify you whenever there is activity in your accounts.   
  1. Download one of the free credit monitoring apps.  Additionally, many credit card companies work with credit monitoring technology firms, and they offer you this service at no additional cost. These won’t stop an event. However, they might discover something sooner than you would without them. 

*FULL DISCLOSURE: Chuck Luce, Sensible Financial’s Chief Compliance Officer & Associate Director of Business Operations, and Sensible Financial are not cybersecurity experts. This article is not intended to fully educate readers on all aspects of phishing threats, cyber threat protection, or cybersecurity. Please talk to your advisor if you have any questions or concerns about keeping your digital information safe and we can point you to some helpful resources.  Here is a great place to start. 

All written content is provided for information purposes only. Opinions expressed herein are solely those of Sensible Financial and Management, LLC, unless otherwise specifically cited. Material presented is believed to be from reliable sources, but no representations are made by our firm as to other parties’ informational accuracy or completeness. Information provided is not investment advice, a recommendation regarding the purchase or sale of a security or the implementation of a strategy or set of strategies. There is no guarantee that any statements, opinions or forecasts provided herein will prove to be correct. Past performance may not be indicative of future results. Indices are not available for direct investment. Any investor who attempts to mimic the performance of an index would incur fees and expenses which would reduce returns. Securities investing involves risk, including the potential for loss of principal. There is no assurance that any investment plan or strategy will be successful.

More articles by Chuck Luce Filed Under: Cybersecurity Tagged With: current events, phishing, security

Primary Sidebar

Sign up for our newsletter

Recent Posts

The picture shows a college campus and students because the article is about FAFSA.

The FAFSA Simplification Act and Financial Aid

The FAFSA Simplification Act makes adjustments to the FAFSA. How will it affect your college student and their financial aid?

The picture shows an older couple hiking on a beautiful day to represent retirement and the SECURE Act.

The SECURE Act 2.0 and Retirement

The SECURE Act 2.0 builds on the initial SECURE Act of 2019, changing the retirement planning space, and increasing retirement flexibility.

Categories

  • College Planning
  • Cybersecurity
  • Estate Planning
  • Financial Planning Basics
  • Financial Planning Videos
  • Insurance & Risk Management
  • Investments
  • Retirement Planning and Cash Flow
  • Sensible Updates

Topics

401(k) Annuities bond returns Bonds Charitable Giving College Planning Company Updates Credit Health Disability Insurance diversification Divorce Donor Advised Funds Economy estate planning Federal Reserve Financial Goals Financial IQ financial planning Financial Strategy Forbes.com housing inflation Investments Investment Strategy IRA Legislation Liquidity Long-Term Care Medicare Mortgage Older Adult Living Recommended Books remote work Retirement Choices retirement planning Retirement Savings Risk Management Securities Social Security Social Security benefits Staff News Stock Market Stocks sustainable portfolios taxes

authors

Rick Miller
Sensible Staff
Frank Napolitano
Rick Fine
Josh Trubow
Chris Andrysiak
Marie St. Clare
Laura Williams
Gyb Spilsbury
Chuck Luce
Aimee Plouffe Polley

Footer

Services

  • Financial Planning
  • Financial Guidance
  • Portfolio Management

About Us

  • Our Philosophy
  • Team

Resources

  • Blog
  • Financial Planning Guidebook
Sign up for our Newsletter
Awards & Recognition

Follow Us

  • Facebook
  • LinkedIn
  • Twitter

Locations

Massachusetts

203 Crescent Street, Suite 404

Waltham, MA 02453

Phone: (781) 642-0890
Fax: (781) 810-4830

 

California

600 B Street, Suite 300

San Diego, CA 92101

Phone: (619) 573-4131​

Disclaimer

This content reflects the opinions of Sensible Financial®. We may change it at any time without notice. We provide this content for informational purposes only. Although we endeavor to keep the information up-to-date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability for a particular purpose or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. We do not intend the information contained in this website as investment advice and we do not recommend that you buy or sell any security. We do not guarantee that our statements, opinions or forecasts will prove to be correct. Past performance does not guarantee future results. You cannot invest directly in any index. If you attempt to mimic the performance of an index, you will incur fees and expenses which will reduce returns. All investing involves risk. You can lose any money you invest. There is no guarantee that any investment plan or strategy will succeed.

More important additional information and full disclaimer.

Copyright © 2023 Sensible Financial · All Rights Are Reserved
Legal Disclosure