PIXM, a cybersecurity specialty firm, reported a large-scale Messenger and Facebook phishing operation that commenced in September 2021 but peaked in April or May 2022, affecting a whopping 8.5 million users. As such, The Ad Firm’s experts in internet marketing in Carlsbad offer a crucial resource to educate users on 3 of Facebook’s most common phishing scams.
On top of illegally acquiring sensitive data or system credentials, phishing poses a significant financial threat. Fortune 100 member IBM (International Business Machines) conducted a study and confirmed that phishing was the 2nd costliest data breach threat type, amounting to massive damage of $4.65 million in 2021 alone.
As such, knowing how to determine and identify a potential phishing scam is crucial in maintaining online safety and security. So, what are phishing scams, and how do you avoid them?
Phishing Scams
Considered the “head honcho” of all online scams, phishing precedes the new millennia, tracing back to the ’90s when cybercriminals posed as AOL administrators in an attempt to gain login credentials for free internet access.
The common focus of cybercriminals is acquiring personal information to satisfy their end goal, whether for identity theft to selling sensitive data on the dark web.
To do this, cybercriminals masquerade as Facebook and alert you of a potential “suspicious login attempt,” with a link logging you into your account. In actuality, the link they provided is a bogus copy of the Facebook login page which will record your credentials to maliciously gain access to your account.
Thankfully, there are surefire ways to detect a potential phishing scam and, by extension – avoid it altogether. First, Facebook emails or notifications about your account will be from either of the following:
- facebookmail.com
- facebook.com
- fb.com
When you send a request or inquiry about your account, you will receive a response from a representative using an official Facebook email account. When you receive an email from a nonprofessional email domain, be wary. Facebook representatives only use their official professional emails when replying to users.
One of the more obvious telltale signs of phishing is poorly written and low-quality content. If the email is riddled with spelling and grammatical errors, more than likely it is a phishing scam – a company of Facebook’s magnitude will never commit these lapses.
Lastly, if the email greeting lacks personalization and starts with a generic “Hello,” or “Good day!”, it is also a likely phishing email. To verify authenticity, you can go directly to your Facebook account, request a password reset, and examine Facebook’s proper email formatting.
Giveaway Scams
As the name suggests, giveaway scams trick users into inputting their personal information, filling out a form or survey, visiting a suspicious website, and the like under false pretenses of acquiring the “prize.”
Cybercriminals usually copy a legitimate page or account, asking users to like, comment, share, and sign up for the competition to increase engagement and reach. Unfortunately, the victims who fell prey to the giveaway scam won’t receive prizes but rather lose sensitive data.
Luckily, there is a failsafe way to avoid falling victim to giveaway scams – only trust verified profiles. You can visit the organization’s verified Facebook account (the one with a blue check mark next to their name) and validate the competition by checking for announcements or messaging them directly.
Fake Warnings
Unfortunately, even organizations and businesses are not immune to potential phishing scams. Cybercriminals gain access to business pages by impersonating Facebook and messaging page owners, warning them of violating Facebook’s terms of service or policies.
The message will include a link to contact Facebook support, redirecting you to a page where you’re prompted to fill out a form before routing you to a fake Facebook login page where they ultimately get ahold of your credentials and account.
It is important to note that Facebook employs and adheres to rigid protocols and standard operating procedures, especially concerning user safety and security. As such, Facebook will send correspondence through the designated and correct platforms, the dedicated support inbox, or their official email – never through regular messaging.
While Facebook is generally vigilant and puts forth numerous safety and security features, cybercriminals can be persistent and creative, always conjuring new ways to deceive users.
The best way to avoid falling prey to phishing scams is to be skeptical, take things with a grain of salt, and verify everything through the proper outlets – only trust information from verified accounts.
