How to Use the SLAM Method to Spot Dangerous Phishing Messages

Phishing remains the most dangerous of online attacks because it’s responsible for most malware infections, data breaches, and account takeovers.

Emails or messages on social media allow an attacker to get in front of less security-savvy users and trick them into taking an action that is going to compromise their security and potentially that of their company.

In May of 2021 alone, phishing attacks increased by 440%. Phishing awareness and detection need to be a major part of any company’s cybersecurity strategy. This means keeping users well trained and continuing ongoing phishing education regularly.

You can’t just provide employees with a phishing fact sheet when they’re hired and expect that to be enough. To develop a strong culture of cybersecurity, you need to remind users in multiple ways about the importance of IT security and continue to sharpen their phishing detection skills.

One method that can make it easier for users to remember how to spot malicious phishing messages is called SLAM. This acronym stands for the different parts of an email or online message a user needs to check before trusting it:

• Sender
• Links
• Attachments
• Message

SLAM is a comprehensive way to keep your team well trained on phishing detection. A staff that can identify phishing emails can significantly reduce your risk of falling victim to cloud account takeover, ransomware infection, data breach, and other costly online attacks. 

The average cost of ransomware remediation has more than doubled to $1.85 million per incident. 

Here is information you can use to create your own SLAM tip sheets, reminder graphics, videos, and other cybersecurity awareness training materials for your team.

SLAM Phishing Attacks by Reviewing These Email Areas

Sender

Review the sender of the message carefully and don’t just assume that the plain text name in the address bar is legitimate.

Phishing attackers will often spoof email addresses, using domain names that they aren’t actually sending the message from. They’ll also use slight misspellings in a domain to fool the eye. Such as using “Amozon.com” instead of “Amazon.com.”

When you’re in a rush and just glancing for a millisecond at the sender link, it’s easy to miss a slight misspelling of a common domain name.

You should carefully review the sender’s email address for any anomalies. Be suspicious of any other domains attached, such as “abc.amazon.com,” the “abc” could represent a phishing domain.

You should also review the source code of any suspicious emails. This can reveal if the message originated from a different domain than is listed as the sender.

Links

Links are used in a majority of phishing emails these days. They will link the user to malicious sites that can do drive-by injections of malware or spoof a login page for a popular site and steal those credentials.

Dangerous links can also be hidden behind images like buttons.

You should always hover over links before clicking them. This will reveal the real URL you are being sent to and will often make a phishing email immediately recognizable – no matter how convincing the message appears.

It’s also best to visit sites directly to check to see if the message is legitimate. For example, if you get an email from “FedEx” claiming your package has an issue that needs to be addressed, instead of clicking the email link, open your browser and go to the FedEx site directly to check your account.

Attachments

All types of file attachments can be used to hide malware inside, even seemingly innocent Word documents and PDFs. You should never open a file attachment from someone you don’t know. And even if the sender appears to be someone you recognize, ask if this email and attachment were expected or not. If not, then check with the person first to see if they actually sent it.

It’s also a good idea to have email filtering and a strong antivirus/anti-malware application on your device that can help detect and block malicious code in file attachments.

Message

Today’s phishing has become quite sophisticated and it’s not as easy to spot a fake. But some will still have slight mistakes when it comes to spelling or grammar.

Look through the message thoroughly, and if anything seems “off,” treat it as if it could be a phishing email, and don’t click any links or open any attachments the message may have.

Another thing to look for is if the personalization on a message is slightly wrong, such as mistyping your name or company name. 

In a phishing message that spoofs another company’s logo and signature see if any dates seem old. For example, if there is a copyright date noted in a signature and it’s not the current year, it could be a scam.

Get Phishing Detection & Response Solutions to Stay Secure

There are mechanisms you can put in place to help reduce the risk of phishing attacks. Quantum PC Services can help your Sturgeon Bay home or business with solutions like DNS filtering, email filtering, managed antivirus, and more.  

Contact us today to learn more! Call 920-256-1214 or reach us online.