A modern threat: staying alert to phishing and vishing

Cybercriminals are becoming increasingly bold and creative in how they target both companies and individuals. Recent high-profile breaches across airlines, other insurance companies  and well-known retailers, highlight how effective modern social engineering can be.  

These attacks are no longer just aimed at corporate systems. Criminals can and do also target customers directly, especially when stolen data gives them the means to personalise their approach.  
 

How these attacks work

Today’s cyber scams often blend multiple techniques to appear convincing and to bypass security checks.  Below is an overview of some of the tactics being used by scammers:

Vishing (voice phishing): Fraudsters call pretending to be company staff member, technical support, or a trusted service provider.  They may used spoofed phone numbers and scripted conversations to pressure people into providing their login details, resetting passwords, or granting remote access to their account.  

Phishing: Fraudsters send realistic looking emails or text messages, that appear to genuinely have come from legitimate sources such as your bank, a retailer, or even your own employer.  These often contain links to fake login pages or provide urgent instructions designed to trick you into revealing your information, providing your Multifactor details, or enabling the fraudster to deliver malicious software that might spy on your activity .  

Credential acquisition:  By combining phone calls, fake emails and SMSs’, attackers can capture passwords, deliver fraudulent multi-factor authentication requests, or take over your accounts entirely, which can lead to identity theft.  
 

Why this matters to you  

Even if you’re not part of a targeted organisation, stolen customer data can make it much easier for criminals to craft highly believable scams. This means you could be contacted by someone who appears to know genuine details about you - making their request seem more legitimate and harder for you to identify.  
 

How to protect yourself

•    Pause before you act: Treat any unexpected call, email, or text asking for credentials or computer access as suspicious.  
•    Check the source: Independently verify requests by contacting the company. Use official contact details and never the ones provided in the message or call.  
•    Be wary of urgency: Messages or calls creating pressure to act quickly are a red flag.  
•    Protect your accounts: Use strong, unique passwords and enable multi-factor authentication wherever possible. Consider using a password manager (one example is Proton Pass but there are many others) to create unique passwords for each of your accounts.  
•    Check if your details have been exposed: Use a trusted service like haveibeenpwned.com to see if your email or passwords have appeared in recent breaches. If they have, change those passwords immediately and avoid using the same password across multiple accounts.

Your awareness and quick action are the best defence against scammers, so it’s important to be vigilant.    

If something feels off, trust your instincts. It’s far safer to double-check something, than to respond in haste. Stay alert. Stay cautious. Stay safe.