Am I being Phished? Remember C.O.P.S

Hello World!

A little preamble to the upcoming guide but I wanted to put out my mnemonic for spotting phishing attacks, email, SMS or voice…

This is all a work in progress, but whilst it isn’t polished by any means… It’s not going to do any harm by me sharing it with you.

Content/Context – Look for spelling errors or improper English. This is quite common with most attacks originating from foreign jurisdictions. You can also look at the formatting of the email, paragraph structure, font size and font type… are they consistent?. Context looks at things like… well have you ordered that amazon gift card or are you actually expecting a delivery? Sometimes you may even get an email for a service you don’t use, or have never signed up to.

Origin – Where does this email/message/contact come from? Your email client will give you often a drop-down box or you’ll need to right click and inspect it closer. What address sent this email and is it expected? Next look at any links and/or buttons and see where they lead… do they match up? Do they seem “off” or are they suspiciously shortened to something like bit.ly to obscure the destination?

Pressure – A common trend in phishing is to apply pressure, this is done through a few methods that are included in the post here if you’re interested. Look for things like time limits and threats. (Be they from the email or the context of the email like “Someone logged into your account”.) But also use the scammer senses and be suspicious of anything too good to be true.

Sensitive – Attackers want information from you! This could be your email and password for X account but could also be something mundane like your date of birth. This would often be obtained with a phishing page that will give you a fake login prompt, click here to see examples of those. But sometimes this takes place through text messages, or voice. Called vishing (Voice phishing.) it’s much harder to spot as phone calls give you little time to think about what’s being asked. Be wary if someone asks for personal information, especially if you didn’t start the contact.