FAQ 1. What is Phishing Email? A form of fraud by which an attacker masquerades as a reputable entity in order to obtain your personal information. Usually appear to be sent from official email address Usually includes attachments, software or an upgrade program containing a virus or spyware. Usually include a hyperlink to a fake website to trick you into disclosing personal data 2. How to identify phishing email? Check the email sender s name and address Phishing email purports to be from a well-known entity, but senders names and addresses differ from those of legitimate organizations. Simply look at the text inside the <> symbols to check out the actual email address. The example below, tells us the sender s address is security@biznetvigator.com, but we can see that the sender s email address is not biznetvigator.com between the < > symbols. This means it is NOT the official email address of Business NETVIGATOR, so could wee be a phishing email.
Pay attention to recipient s name email Some phishing emails maybe be sent to a group which does not include your name. Check the hyperlink s website layout Phishing email normally contains a hyperlink to a bogus website that uses a URL and domain name similar to a legitimate entity s site. A phishing website may include logos or other identifying information taken directly from a genuine website, making it difficult to discern a fake from the real thing. If in doubt, check with the organization concerned. Below is an example for illustration. The URL of phishing website is very similar to the real website s, and the phishing website layout looks almost the same as the authentic one too. REAL Website: https://www.biznetvigator.com/chi/homepage.php
FAKE Website: https://www.biznetvigatoronline.com/chi/homepage.php Check the hyperlinked web address Phishing hyperlinks are normally similar to legitimate URLs. Use of subdomains and misspelled URLs known as typo squatting are common tricks, as is homograph spoofing whereby URLs are created using characters to read exactly like a trusted domain. You can simply mouse over a hyperlink to check out its real URL address.
Below is an example for illustration: Email content containing threatening words Some phishing emails contain threats or an emergency alert. For example, you could be told your account information is invalid, or your email capacity is almost exhausted, so you are asked to provide credit information, or login to your account via the URL provided. Flawed grammar in phishing email content Most email issued by large companies goes through an editorial quality process, so if an email s grammar is sub-standard, it could be a phishing attempt. 3. What can I do to avoid phishing scams Install anti-virus software Reliable anti-virus software is designed to detect and deal with most kinds of phishing email, as well as viruses, spyware, malware and Trojans. Such software should be installed on all internet devices such as mobile phones and tablets. Activate spam-filtering functionality
Business NETVIGATOR s Anti-Spamming Service VAS feature aims to block spam and phishing emails. It automatically sends them to spam folders to minimize email-based hacker attacks. Change your email password frequently You should change your email password periodically - and use a different password combination to register for online services. This can reduce the risk of your account being hacked. Never open suspicious emails or attachments If you suspect you have received a phishing email, do NOT click on any link or attachment. Remember, you can always make a quick call to verify authenticity. You can also seek assistance from your email service provider. And if you receive an email asking you to verify your personal or account information such as by revealing passwords, online banking login information, or credit card numbers resist any temptation to comply. 4. How did the phishers get company or user s information? For cybercriminals they have tools which can automatically search and collect user s email addresses (together with other info such as company name and address) from web pages, social media sites, forums, blogs, etc.. Phishing emails will be sent to these email addresses. Phishing email may appear to be sent from our official email address, in a way phishing senders masquerade as an official entity to lower the alertness of recipients and makes false statements such as suggesting the recipient s monthly subscription to trick recipients in providing company details or financial information. 5. What if company or my personal email account, bank account, or other accounts were compromised? Immediately change the passwords for any potentially compromised accounts Contact your bank or financial advisor to let them know your accounts may be compromised and ask them to put a fraud alert on your accounts Check your bank and financial statements and credit reports to regularly to identify any false charges or suspicious activity If you believe you are a victim of identity theft, please report your case to Hong Kong Police Force
6. Do I only need to worry about Phishing attacks via email? No. Phishing attacks can also occur through phone calls, texts, instant messaging, or malware on your computer which can track how you use your computer and send valuable information to identity thieves. It is important to be vigilant at all times and remain suspicious of sources that ask for your credentials and other personal information. 7. Why can t Email Service Providers stop these types of messages? HKT does stop over many spam, phishing and virus-related email messages per day. However, the technology used to send spam and phishing emails is constantly changing. While blocking these messages helps, unfortunately there s no substitute for all of us also being vigilant to avoid being fooled by those messages that do get through. 8. What should I do if I receive phishing spam? If you receive suspicious e-mail, please do NOT reply and notify us at bizts@biznetvigator.com. Our security team will investigate and work with the appropriate authorities to block a fraudulent email account or website as soon as possible. 9. What risks are involved if replied a phishing email? If you reply to a phishing scam with your username and password you have provided the scammer access to your bank or other financial accounts. In addition your email will be used to send thousands of spam email to others on and off your contacts. 10. What are the types of questions that HKT will never ask in an email? We will never ask for the following personal information in an email: Credit and debit card numbers Bank account numbers HKID or passport number Driving license number Email addresses and password