Secure, flexible, scalable
end-user computing

While the internet has many benefits for modern businesses, there are also some issues to be aware of within the online space. With this, it’s vital to be aware of the malicious actions that a bad-faith actor can take to, at worst, damage your company.

Emails are one of the most vulnerable points at which your company could be in danger. With many different attacks and vulnerabilities involving social engineering, even a simple click on a link within an email could cause tons of damage. But, some methods are more dangerous than others.

In this article, we’re going to go over the difference between spam emails and phishing emails, and how you can protect your business from them.

What is a Spam Email?

Spam email (or junk mail) is a type of email that is quite common online. In fact, you probably have at least some spam within your email ‘Spam’ folder right now. 

These kinds of emails are simply just a form of mass marketing, that is used to advertise a service (whether it be a legitimate service or a scam) for sale to a large number of people with ease. 

Email spammers tend to acquire their victims’ email addresses from a wide range of sources and constantly bulk-send advertisements to their list of emails, not caring about who’s on there.

Commonly, you’ll see spam emails advertising adult websites, gambling websites, and insurance websites. These are usually scams, though it’s incredibly easy to tell that these emails are spam and will be put into your email client’s spam folder automatically so you don’t have to manually delete them.

However, even newsletters and other opt-in emails from legitimate places are seen as spam. Generally, spam is just unwanted/unsolicited emails, and there’s nothing inherently malicious about another email saying that there’s a sale at a clothes shop — even if they can be annoying.

Phishing is much more dangerous and malicious, however…

What is a Phishing Email?

A phishing email is an email that is designed to intentionally deceive the recipient into giving access to an account or service. This social engineering scam is one of the most dangerous online attacks, as it takes advantage of unsuspecting or vulnerable people first and foremost.

Unlike low-effort spam mail, these emails are designed to trick unsuspecting victims into handing over sensitive information such as passwords, bank information, and even administrative access to a business system in the worst case.

The key to phishing scams is that they look legitimate at first glance, and are designed to trigger the recipient to panic. They’ll often say something like “Your account has withdrawn £1294.90” and look deceptively similar to an email from a bank — in the example of a bank phishing scam — and will redirect you to a fake login portal to try to get you to enter your bank login. 

These emails are easy to spot to the trained eye — as we’ll go over further on — but even those who are experts can be tricked. For example, famous cybersecurity expert and scam exposer Jim Browning fell victim to a very realistic-looking phishing attack that temporarily restricted access to his whole YouTube channel.

This video is his recounting of the scam, and is a great example of the types of high-level phishing attacks that you may encounter:

(Embed: https://www.youtube.com/watch?v=YIWV5fSaUB8)

Key Differences

With these attacks becoming harder to spot every day, it’s important to educate yourself on how to stop them. To do so, you need to know the key differences between general spam and phishing.

• Spam emails will generally appear (and often will be) benign, but phishing emails will use specific language to create a sense of urgency.
• Where spam emails will often be incredibly low quality, phishing emails will look realistic to try to convince you that it is in fact a real email.
• Phishing emails will always try their hardest to emulate coming from a real company — such as the actual layout of the email and the email address (a phishing email may use — in the example of Lloyds Bank — Admin@LIoydsBank.com (the second L in the ‘Lloyds’ is actually i).

Otherwise, there isn’t much of a difference between the two, as phishing is generally considered to be a type of spam email. However, while spam is usually annoying and harmless, phishing is deadly and dangerous.

How to Protect Your Business

There are several steps that your business can take to protect itself from spam and (more importantly) phishing.

• Recognise the Signs of a Phishing Attack

Phishing attacks will often have some telltale signs that will be able to signal to you that they’re coming from a malicious source.

• Check the email domain, and use Google to verify the domain of the company that the email is ‘from’. For example, if you get an email from Admin@L(i)oydsBank.com, check their official website to see what email address domains they use.
• The emails will often visually look off too. The layout may be slightly different to a normal piece of comms from said company. Trust your gut here — if something seems off, it usually is.
• Check for misspelt words and misentered URLs. Any mistake in the email is a massive red flag for a phishing attack.
• Look at the language of the email. Is it what would usually be sent by the company trying to contact you? Are they being pushy? Again, use your judgement here.

Generally, when using your judgement, be suspicious of any email you receive in general. Make sure to do the correct research before taking action.

• Ensure Company-Wide Training and Security Compliance

It’s great that you know the signs. But, if your employees don’t, they could fall victim to an attack without knowing.

• Ensure that each employee is trained on phishing and cybersecurity.
• Create company-wide rules on risk factors such as external links and online forms.
• Restrict the ability of employees to download files from unauthorised sources.
• Stress the importance of good cybersecurity practices throughout your workplace.

By ensuring that everyone is prepared and knowledgeable about the risks of phishing, you protect your company.

• Implement System-Wide Measures to Protect Your Company

Even with all of this, humans make mistakes. Sometimes, you’ll click a bad link by accident. Ensuring that there are systems in place for this is important.

• Implement an email security solution which blocks phishing emails before they reach an employee’s inbox.
• Ensure that there’s good system-wide antivirus software.
• Back up your important files and data regularly, to restore your system in the event of an antivirus account.
• Enforce good password hygiene to ensure that breached passwords can’t be re-utilised.

Need a Hand?

With the looming threat of phishing and spam being a serious consideration for any business, knowing how to protect yourself is vital for the success of any business. Knowing the key risk factors and threats that could put your business in danger is important, as acknowledging these risks is the best way to stop them.

Are you looking to implement securities and strengthen your company’s vulnerability against social engineering attacks? Get in touch with us today! Our experts are here to help, and can easily make sure that your company has every base covered.