How to Protect Your Practice From Spear Phishing Attacks

95% of all cyberattacks targeting enterprise networks in 2020 were caused by spear phishing. That statistic should worry you if your practice is not well protected and your staff is not trained to spot cyberthreats.

We can only speculate and say that this alarmingly high number was due to everyone already fatigued by the waves of problems brought by the COVID-19 pandemic. We’ve been prioritizing our physical health and may have overlooked other dangers like the threats lurking in our networks and computers. 

While we have made adjustments over a year into the pandemic, it’s time to bring our attention to the growing number of cyberthreats such as phishing and social engineering.

In the middle of uncertainty and panic, one important thing has been proven to be true all over again: prevention is better than cure. To prevent a cyberattack, you must know how attackers operate and what you can do to prevent them from wreaking havoc in your practice.

What Is a Phishing Attack?

Phishing is a type of social engineering attack in which a scammer uses emails, texts, and social media messages to trick their victims into doing certain actions: share sensitive data like passwords or bank account numbers; or download a harmful file that installs malware on their device.

Most phishing attacks happen via email and learning about them could be the most crucial part of your practice’s cybersecurity.

Spear Phishing: How It Can Affect Your Practice

Capitalizing on the recent COVID-19 vaccine updates, phishing attacks targeting healthcare practices jumped by almost 200% from December 2020 to February 2021.

Spear phishing is an email phishing scam that targets a specific person or organization. The attacker pretends to be from a reputable organization or someone that the victim already knows.

Compared to other types of phishing attacks, the success of spear phishing comes from extensive research of a target's background and behavior. The attacker may even play the long game and communicate with you for months before they trick you into doing something.

For example, a clinic is looking forward to getting their delivery of COVID-19 vaccines. A scammer pretending to be a vaccine manufacturer will send an email (or a series of emails) to one of the clinic’s staff until they get what they want—money or valuable clinic data.

How to Recognize a Spear Phishing Email

What’s scary about spear phishing is how its emails can look legitimate and easily fool even the most perceptive individuals.

At first glance, a spear phishing email will look like something you receive from a reputable sender like a bank, another hospital, or a third-party vendor. A corporate employee can even get emails from someone pretending to be a coworker.

Here are actions you can take to spot spear phishing:

Scrutinize the email’s subject line.

This malicious email can contain words that are intended to pressure the recipient to take immediate action.

Look out for words like:

• Emergency
• Hurry
• Urgent
• ASAP
• Payment
• Account Number
• Patient Information
• Send immediately
• Transfer now

However, your regular contacts may use some of these words. The next steps can help you verify your suspicions should you receive a potentially devastating email.

Check the sender’s email address.

We can only view the sender's name upon receiving an email. If you don't investigate any further, you can fall victim to a spear phishing attack in a very short time. 

Always make sure to look at the sender's email address. If an email seems suspicious, call the person for verification. If the email turns out to be legitimate, tell the sender that you’re just taking precautions.

If you can't make a call, simply ignore the email. If the message is urgent and requires sending of sensitive information, the sender will probably be the one to call you instead.

Look out for irregularities in the email body.

As for the email’s content, you can check for unusual words and terminologies.

Be cautious if the content includes expressions you don't usually hear from this person. Or when you know this person has installed Grammarly premium, yet their email contains a high number of grammatical and spelling errors.

Verify embedded links.

No matter how urgent the email seems, you should remain calm and continue exercising caution. You can simply hover your mouse over a link to check the source.

Scan file attachments.

This is where email security tools come in. If you already have one, your software may automatically scan file attachments for malwares, depending on its settings.