Phishing attacks: Seasons of increased risk and how to safeguard your organization

Although phishing attacks can occur at any time, certain seasons and periods pose a greater threat. These spikes in activity can often be explained by changes in consumer behavior, events, or even the psychology of the attackers. Here are the times when you’re most at risk for phishing attacks:

1. Around the holidays (November through January)
   The holiday season is a time when businesses and consumers are highly involved in online shopping, gift-giving, and managing finances. This presents cybercriminals with the perfect opportunity to pose as trusted brands or companies. This includes fake emails seemingly from online stores or payment platforms, asking you to update your information for a delivery or to claim your ‘prize-winning’ holiday gifts. Phishing attacks during this period often take advantage of the stress and rush people experience, making them less cautious.
2. Tax season (March through June)
   Another peak period for phishing is during the spring, just before tax deadlines or during the tax season, when people are focused on filing their tax returns. Cybercriminals capitalize on the confusion and stress surrounding taxes to mislead individuals. During this time, fraudulent emails may appear to come from the tax authorities or other government agencies, asking recipients for personal information or payments. Since tax returns are often filed online, people are more likely to quickly agree to requests without properly verifying the source.
3. Back-to-school season (August and September)
   The period when parents and students are preparing for a new school year also presents opportunities for cybercriminals. They often target parents who are purchasing books, school supplies, or even laptops for their children. Phishing attacks during this time may appear as discount offers or fake messages from educational institutions allegedly needing information to complete enrollment or payment processes. The combination of looking for deals and the busy back-to-school schedule means people are less careful about verifying suspicious messages.
4. Summer holidays (July and August)
   The summer months can also bring an increased risk, especially when people are on vacation or during the holiday seasons when company staff are away. Cybercriminals may take advantage of key personnel being absent by sending fake emails requesting urgent payments or login credentials for supposed ‘vacation discounts.’ Since employees are often more relaxed and less alert during the summer months, they may be more likely to fall for such attacks.

Given the rise in phishing attacks during certain seasons, it’s crucial to be extra cautious. Here are some tips to help safeguard yourself:

1. Be careful with email attachments and links:
   Don’t click on links in emails or attachments from unknown senders. Always verify the email address and visit the website via a new tab in your browser to log in or conduct transactions.
2. Check the sender:
   Phishing attacks often use fake email addresses that mimic a trusted brand. Pay close attention to small discrepancies in the name or domain.
3. Use a spam filter:
   Ensure your email settings have a spam filter activated to automatically block suspicious messages.
4. Enable two-factor authentication:
   Wherever possible, enable two-factor authentication (2FA) for your online accounts, so that even if your login details are stolen, the attacker still needs a second security layer.
5. Educate yourself and your employees:
   Be aware of common phishing tactics and learn how to spot suspicious messages. Businesses should regularly train their staff to recognize phishing attacks.