In this episode of Byte Sized Security, host Marc David talks with expert Ethan Winnobego about how to recognize and avoid phishing scams trying to steal your personal information. They discuss:

• What phishing is and the major security risks it poses
• Common phishing techniques like fake login alerts and malicious links
• Red flags to watch out for like urgent requests for info and odd URLs
• Steps to take if you suspect a phishing attempt
• Safety measures like strong passwords, multi-factor authentication, and training
• How companies and institutions can help defend against phishing
• Why you should slow down and verify legitimacy before acting
• Key advice for individuals to thwart phishing attempts

For full episode recaps, subscribe to Byte Sized Security wherever you get your podcasts or visit our website bytesizedsecurity.show. See you next time!

Welcome to another edition of Byte Sized Security, the bite-sized

cybersecurity podcast served up by me, your host Marc David.

Phishing remains one of the top threats to our online safety.

Today I speak with security expert Ethan Winnobego about how to recognize

and avoid phishing attempts aimed at stealing your personal information.

Stay tuned to learn easy tips that can prevent you from getting

hooked by a phishing scam.

Thanks for joining me Ethan!

It's Winnobego right?

Happy to be here.

Yes, you are correct.

Winnobego.

It's Irish.

First off, can you explain what exactly phishing is and why

it's such a major security risk?

Sure.

Phishing is a type of social engineering cyberattack where criminals try

to trick users into handing over sensitive information or clicking

on malicious links by disguising themselves as trustworthy sources.

They create fake websites, emails, texts and more designed

to look like they’re from banks, companies, or contacts you know.

But once you input your login credentials or click their links, they

can steal your financial and personal information or infect your device.

So simple human error can lead to major consequences.

What are some common phishing techniques people need to watch out for?

Classic phishing emails are ones pretending to be account

alerts asking you to log back in.

Links in emails and texts bringing you to fake login pages are also popular.

Pop-up warnings about device infections that include a phone

number to call can be phishing.

And then there are more personalized spear-phishing attempts targeting

you specifically with info scammers have gathered on you.

Yikes, they sure get creative don’t they?

What are some ways people can spot potential phishing attempts?

The number one red flag is any unsolicited email, text or call

asking you to urgently verify or re-enter your personal information.

Things like wrong domain names in emails, spelling errors, threatening

language demanding you act, or odd links should raise suspicion.

Your bank won't email asking for your password out of the blue.

Also be wary of offers that look too good to be true.

Great tips.

If someone suspects a phishing attempt, what should they do?

Don’t click any links or call phone numbers provided.

Check the sender’s domain or email closely to confirm it’s your real

bank or company contacting you.

Call the published customer service number to verify any urgent notices.

Report the phishing attempt to the appropriate institutions.

And contact your bank if you shared financial information just to be safe.

The key is avoiding quick reactions until you can confirm an alert is legitimate.

What security measures can people take to protect themselves from

getting phished in the first place?

Using unique complex passwords for every account limits criminals accessing

multiple sites if one password is stolen.

Enabling multi-factor authentication provides extra login protection.

Installing anti-phishing browser extensions can detect fake pages.

Keeping software updated blocks exploitation.

Education about the signs of phishing goes a long way too.

And backing up your data provides recovery ability if an attack still occurs.

With phishing so rampant, can companies really help address this?

Absolutely.

Implementing security awareness training helps educate employees

who are common targets.

Advanced email filtering before messages reach inboxes detects many phishing lures.

Monitoring activity helps flag when credentials or data

are being accessed unusually.

And offering services like MFA and login alerts empowers

people to protect themselves.

Defense against phishing takes both individual vigilance and

proactive security from institutions.

Excellent overview on how phishing works and how we can avoid

getting hooked by these scams.

Any final advice?

Slow down and use common sense when faced with urgent security notices.

And don't let fear push you into hasty reactions - that's

exactly what phishers want.

If something seems questionable, take the time to verify through

known trusted channels before providing info or clicking.

A little caution goes a long way in thwarting phishing.

Wise words.

Thank you Ethan for your tips on spotting and stopping phishing attacks!

Happy I could help shed some light on this threat.

We covered a lot of ground on how to recognize and respond to phishing

attempts aimed at deceiving you.

Stay vigilant for red flags and verify legitimacy before acting.

For recaps and more security lessons, head to our site byte sized security.show.

We'll see you next episode - until then watch out for the phish!