Intel Security published an interesting study in which it examines consumers' knowledge of phishing practices and whether they have the ability to detect phishing emails.
For this study, Intel Security presented 10 emails that people taking part in the survey were asked to respond to and determine which emails were phishing intended to steal personal information, and which were normal, legitimate emails. Data for the study was collected from 144 countries and 19,000 people were surveyed.
“To help consumers spot popular phishing attacks, we created a quiz to help people learn how to properly identify phishing emails. We distributed 10 real emails and respondents rated whether they were real, or really dangerous. We’ve been doing this for a while, and now that we have the test results, corrected and scored, it’s time to take a look at how everyone did,” Intel Security says on its official blog.
The results were:
- Only 3% got all the answers correct.
- 80% of respondents had given at least one incorrect answer
- The global average is 65.4%, which means that respondents “missed” one in four phishing emails on average.
If 80% gave at least one incorrect answer, this means that the attacker has found an "open door", since all he needs is just one wrong move of ours to seize the opportunity.
Another interesting finding from the email study is that the majority of respondents gave an incorrect answer about whether the email was legitimate. Generally, users associate “free money” with phishing campaigns, and this was the main reason why many gave an incorrect answer here.
"Phishing emails often look like they come from trusted sites, but they are designed to trick users into sharing their personal information,"
"Review emails carefully and check for typical phishing signs including poor visuals and inaccurate grammar, which can indicate the email was sent by a scammer," said Gary Davis, Chief Consumer Security Evangelist at Intel Security.
Using the advice provided by Gary Davis of Intel Security, you can follow the following tips to improve your defense against phishing attacks:
- Keep your security software and browsers up to date
- Examine links to identify obvious fakes, make sure an embedded link takes you to the exact website you need.
- Inspect the email carefully for obvious red flags: misspelled words, incorrect URL domains, unprofessional and suspicious visuals, and unknown senders.
- Instead of clicking on a link sent to you via email, visit the website of the company that allegedly sent the email to make sure it actually comes from the company itself.
Don'ts:
- Do not click on any links in any email sent to you from an unknown or suspicious sender.
- Do not send an email that seems suspicious to your friends or family, as this will spread the phishing attack
- Do not download a file or content that your browser or security software warns you may be malicious.
- Do not give any personal information, such as your credit card number, home address, or social security number, to a site or email address that you think may be suspicious.
