The use of impersonating a person or brand as part of an attack in on the rise, giving attackers the upper hand, establishing instant credibility and lowering the defenses of the potential victim.
The first goal of any phishing attack is to establish context around who is sending the email. And according to email security vendor Agari, the bad guys are laser-focused on using both brand and personal identity deception to accomplish this. According to their recent Q4 2019: Email Fraud & Identity Deception Trends report, attacks impersonating individuals nearly doubled in Q3, rising from 12% of all impersonation attacks to 22%.
Of all advanced email attacks in Q3 of this year, nearly two-thirds of them (62%) used some form of identity deception. Brands continue to dominate – representing 42% of all impersonation attacks – where something as simple as a display name of “UPS Shipping Notification” may be all that’s needed. Look-alike domains (think chaase.com) also remain an issue, also representing 22% of attacks.
With the goal being to trick users into diverting payroll, initiating a fraudulent wire transfer, or obtaining gift cards, the use of identity deception – particularly in the case of impersonating an individual – is rather compelling. An email to payroll about modifying banking details from what appears to be an employee’s external email address is somewhat believable.
Organizations need to elevate their user’s understanding of how these tactics are used and the scams that exist via Security Awareness Training. By educating them, users can spot potential phishing scams that may be designed to trick users through the use of identity deception.
Here's how it works:
