How to stay safe from phishing while working from home

Email scams are more sophisticated than ever, but you can still keep yourself (and your business) safe by taking some necessary due diligence.

Table of Contents

• 1. Stay up to date on the latest email scams
• 2. Learn how to identify Phishing
• 3. Think carefully before clicking
• 4. Pay more attention to public Wi-Fi
• 5. Use software to minimize phishing attempts

1. Stay up to date on the latest email scams

Knowledge really is power when it comes to protecting your business from cybercrime. If you know what to look for, just a glance at a shady email or SMS message is enough to set off your internal alarm bells.

Classic email scams where someone pretends to be your bank to steal your data are relatively easy to spot. Chances are you've been targeted at random multiple times through one of many shotgun methods.

But as a remote worker, you’ll also have to become a master at spotting targeted email scams. These are much harder to spot because they often include specific information about you or your company. In other words, the hacker has done their research and therefore seems more convincing.

Along with Spear Phishing , you may also encounter email scams, in which you receive copies of legitimate communications with dangerous attachments or links.

Unfortunately, AI has made things much scarier, including Vishing . Previously, scammers would call you and pretend to be someone else. Now, they can actually copy the voice (and image via deepfake video) of someone in your organization.

You should be familiar with all of these techniques as they can ensure that you think twice before clicking on a link in a seemingly safe email from your colleague.

2. Learn how to identify Phishing

Learning how to spot Phishing is relatively simple. The first thing you should look at is the sender’s email address. In most cases, you’ll notice that while it looks very similar to an official organization (or group member), some of the letters may be swapped out for a similar symbol, or one of the letters may be omitted altogether.

The most obvious sign of a scam is often language that creates a sense of urgency. Cybercriminals are trying to take advantage of people who may not have the experience to recognize scams, and thus create situations that require you to act quickly without thinking.

In the past, phishing emails were often full of grammatical errors and typos. Today, cybercriminals often use AI language models to create more polished text that is good enough to fool most unsuspecting individuals.

You can spot AI phishing attacks by their unnatural sentence flow. Email text is also often overly formal or perfect, lacking any human touch that is a hallmark of most work-related communications.

Here is an example of an email created using Google's Gemini:

It may look fine on the surface but upon closer inspection it turns out to be very problematic. If you ever receive a similar email, contact the alleged sender directly to clear up any confusion rather than taking any risks.

With voice cloning and deepfakes, things get a little more complicated. The good news is that most cybercriminals are looking to make a quick buck, so cloning a manager’s voice and image can be too much work. As a result, most of us will never have to deal with this type of scam. However, while the chances are low, it can happen, so it’s definitely worth knowing the basics.

For example, voice cloning can sound convincing, but digital artifacts can still be noticeable today that make the speaker sound robotic. The cadence and small inflections of the voice will be off even though the timbre is perfect.

The same goes for detecting deepfakes, where you might notice imperfections like jerky movements or broken lip sync. Either way, you know your co-workers well enough to be familiar with their gestures, so anything that seems out of the ordinary is a big red flag for you.

3. Think carefully before clicking

Whenever you receive a link in an email (even from a familiar address), always check it by hovering your cursor over it. First, check the domain name (aka the first part of the link). Just as scammers try to make email addresses look legitimate, they do the same with the domain names in the links they send you.

Look for spelling mistakes, hyphens, and missing or extra letters.

The purpose of the scam is to steal your login information or get you to download malware, so the link will try to mimic a legitimate service.

Likewise, you should be wary of any file attachments. This includes executable files (.exe) and compressed files (.zip, .rar) that cybercriminals love because they can easily hide malware, as well as Microsoft Office documents that now allow hackers to set up scripts and macros that function similarly to .exe files.

4. Pay more attention to public Wi-Fi

The great thing about working remotely is that you can take your work with you wherever you go. While this is great for your mental health, it does come with its own cybersecurity risks, primarily due to Wi-Fi phishing or Wi-Fi spoofing.

In this scenario (often referred to as a Man-in-the-Middle attack ), the hacker creates a “twin” network of an actual Wi-Fi hotspot in a public place. Then, they simply wait for the victim to establish a connection to see everything they do online, including their login information.

There are a number of things you should prepare for if you plan to work in coffee shops and other public places like libraries, mainly cybersecurity. To avoid falling victim to Wi-Fi spoofing, it’s best to avoid public Wi-Fi altogether, especially if you’re handling sensitive company data. Always carry a mobile hotspot or use a 4G/5G connection to minimize risk and avoid traffic congestion.

If you absolutely insist on using public networks, you should install a VPN first to be safe.

5. Use software to minimize phishing attempts

Why do it yourself when there is software that can help you? For example, the premium version of Malwarebytes can significantly enhance your online security and protect you not only from malware but also from scams.

With real-time scanning, Malwarebytes analyzes incoming emails and automatically blocks them if it detects any phishing messages. Malwarebytes also analyzes links in emails to check if they are safe, along with scrutinizing the content of the messages themselves. Malwarebytes can also verify that the sender of an email is authentic by comparing their details with available information. This makes it a powerful tool against email spoofing.

While this is an optional step, it adds an extra layer of defense against the growing number of scams and also reduces your “phishing” workload.

By practicing due diligence, analyzing links and attachments in emails, you will avoid falling victim to a scam. Indeed, adding AI to the mix doesn’t help, but the same rules still apply – stay alert, don’t fall for high-pressure tactics, question everything, and the AI ​​won’t have anything on you!