YT YouTube2Text

YouTube2Text → Transcripts → YouTube transcript (bNzN5eKY2rM)

YouTube transcript (bNzN5eKY2rM) — Transcript

4,147 words · 638 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:03Hello and welcome to this free training
0:05session on fishing, smishing, fishing,
0:07and farming. My name is Paul Rogers and
0:10I am a cyber security trainer and CEO of
0:13DPO Solutions, which is a cyber security
0:15training company. So before we start, uh
0:19I really appreciate your participation
0:20and if I could ask you to subscribe to
0:22this channel and then if you find it
0:24useful, be sure to like and share and
0:26even add it to a playlist so you can
0:28always come back to it later. So with
0:31that said, let's get started and move on
0:33to the introduction.
0:37So this video is part two of the cyber
0:39security awareness training series and
0:42is a follow-up to our fishing awareness
0:44training video which are both found on
0:46our DPOS solutions channel at
0:48dpossolutions.privacy.
0:50So this training course focuses on
0:52practical examples of fishing, smishing,
0:55fishing and farming with a look at some
0:58real world attacks which have happened
1:00over the last few years. Attacks like
1:02these have led to over 246 million
1:05ransomware attacks last year, causing an
1:08average of 9.6 million in damages in the
1:11US when data breaches uh become
1:13successful. So, we hope this training
1:16will increase vigilance and awareness
1:18with specific steps to take when
1:20reviewing suspect emails, text messages,
1:23and voicemails on your devices. And
1:25don't forget there are additional
1:26resource download links and information
1:28in the video's description which can
1:31help you with your training journey.
1:34So I like to use my own methodology for
1:37scanning fishing communications and I
1:39call it scan which I developed and
1:41includes four steps. These four steps
1:43are screen check attachments and note
1:47and are used to generate an overall risk
1:49score or fishing threat level. So let's
1:52take a look at each of these on the next
1:54slide to show you what this involves.
1:58[Music]
2:02So the first step in the scan
2:04methodology is screening communications
2:07which is really a quick evaluation of
2:09the probability that the this email,
2:11text message or voicemail is a normal
2:13communication. In other words, you're
2:16asking yourself whether on the balance
2:17of probability that I would receive a
2:19message like this from this person or
2:21business and whether it's unusual in any
2:23way. If it is unusual, it's time to
2:26raise the threat level in your mind from
2:28low to moderate and start raising your
2:30vigilance level straight away.
2:34So, next is the check phase, which
2:36involves looking at the email heading
2:38for odd or inconsistent elements. This,
2:41as we'll see shortly in our examples,
2:43could be things like unusual email
2:45addresses, undisclosed recipients in the
2:47two or CC field, misspelling in the
2:50subject line, and even a message
2:52timestamp, which indicates that the
2:54message could have been sent in the
2:55early hours of the morning, perhaps
2:57indicating a country in a different time
2:59zone. Any of these things would be a
3:02cause to raise the scan threat level to
3:04high for moderate on the slide before.
3:09Next, we look for attachments and links.
3:12Attachments from untrusted sources and
3:14links which lead to untrustworthy sites
3:17pose a very high risk raising the score
3:20to very high here on our chart. The
3:23obvious advice here is never to open
3:24unexpected attachments and if there are
3:27links in the email to hover over them
3:29and instead of clicking on them. If the
3:32link is suspicious at all, then the risk
3:34gets put up to severe as the site is
3:37probably a source of malware or or a
3:39location where you personal data will be
3:41compromised. So, watch out in particular
3:43for this step.
3:46So in the last step of our scan
3:48methodology, we look at taking note of
3:51pressure words like urgent, act now,
3:53misdelivery, penalty, cancel, suspended,
3:56refund, or timelimited offer, which are
3:59really baiting victims into some kind of
4:01action like clicking on the link. In
4:04combination with the previous steps,
4:06this would bring the risk level to a
4:07severe threat and would almost certainly
4:09be a fishing email.
4:14With this methodology in mind, we can
4:16take a look at some common examples of
4:18fishing emails over the next few slides
4:21and see how we might far applying our
4:23scan methodology. So, first on our list
4:26is an Amazon Prime scam.
4:32[Music]
4:34This email is a severe risk from Amazon
4:36Prime as all the criteria for our scan
4:39methodology have been triggered. So, how
4:41is this so? Well, firstly, this would
4:44not be a run-of-the-mill email as you
4:46may never or rarely have received one
4:48like it before. Then, when we check the
4:50address header, we see an odd email
4:53address in the form field. Next, when we
4:55hover over the yellow button, update
4:57payment information, we see a suspect
5:00link which doesn't match with an Amazon
5:02site. And then, of course, lastly, there
5:04are pressure words in the body of the
5:06email. So in this case, if you don't
5:09update your card in the next 24 hours, a
5:11bad thing will happen, which in this
5:13case is losing access to your account
5:15per permanently.
5:18Again, similar to the last email, we see
5:20problems with the address field in the
5:22form of undisclosed recipients and a
5:25lookalike Bank of America email domain
5:27domain in the from field, which doesn't
5:29resolve to a real website when you
5:31search for it in Google. There's also a
5:33fake link and pressure words like
5:35unusual activity which are designed to
5:37get a reader to react. Again, the risk
5:40here would be severe that if you did
5:42actually visit the fake site, you would
5:44likely be downloading malware or giving
5:46over personal information to be later
5:48sold and used in identity theft, credit
5:51card fraud, or password stealing.
5:55So, CEO fraud. So, this is a type of
5:58fishing attempt where an email comes
6:00from what looks to be the CEO or some
6:02other company executive urgently
6:05instructing employees to transfer funds
6:07or share sensitive information. They
6:09often emphasizing confidentiality or
6:12time sensitivity to prevent
6:14verification.
6:15This creates a sense of pressure and
6:17authority making employees less likely
6:19to question the request. This is also a
6:22severe risk email as it's highly
6:24unlikely that a CEO would be emailing
6:26emailing you directly with the request
6:28like this and and an attachment involved
6:31and the words urgent also enclosed in
6:33the email. This type of email would need
6:36a secondary form of confirmation in some
6:38way if there's a chance that you believe
6:40it's authentic i.e. a phone call or
6:43other in-house approval process which
6:46requires a formal sign off and not just
6:49responding to an email.
6:55So now we'll briefly cover a few other
6:57types of scams like the Dropbox and
6:59Microsoft Security Alert package
7:01delivery and a few others. So let's jump
7:03in there.
7:07So here in the Dropbox scam um you'll
7:10see that a fishing email comes in
7:11appears to be from Dropbox notifying
7:14users that a file has been shared with
7:16them. uh message includes a link to view
7:18the file but clicking on it leads to a
7:21fake Dropbox login page. So if users
7:24enter the credentials here on this page,
7:26scammers will capture their login
7:28information and perhaps log in later to
7:30search for personal information exposing
7:32your personal data.
7:35So here we have a Microsoft security
7:37alert. So, with this fishing type, an
7:39email appears to pretend to be from a
7:42well-known brand, which in this case is
7:45Microsoft, and it's asking you to keep
7:48your account secure, that there's a
7:49possible uh compromise involved. But of
7:52course, remember that over 90% of these
7:54E types of emails are fake in
7:56particularly in cases where the email is
7:58unsolicited. So, in other words,
8:00Microsoft will only send out this kind
8:02of email when you request a reset and
8:05will ask you to direct you to use an
8:07authenticator app rather than visiting a
8:09site to reset your password. You'll
8:11likely find that you have to look a
8:13little harder in these types of emails
8:15to detect the fraud as there are some
8:17real email addresses used in the header.
8:20But hovering over the recover account
8:22button in this case will likely reveal a
8:25link to a scam website. It won't be a
8:27Microsoft website, in other words.
8:30Next we have the uh fake delivery email
8:33appears to be from a brand such as UPS
8:36or DHL or one of the others asking you
8:39urgently to verify your account. This is
8:41similar to the Microsoft keep your
8:43account secure. The link provided
8:45usually leads to a fake login page again
8:48to to designed to capture your login
8:51details. Again, the rating here would be
8:53high uh very high rather um and that the
8:57the fake page would likely capture your
9:00personal details which would be used
9:01later to compromise your personal data.
9:06So, this is another version of what we
9:08shown before, a PayPal scam. This case,
9:11it's warning of suspicious activity and
9:13that your account may be frozen.
9:15Obviously, if you click on the link, um
9:17the same thing will happen in the
9:19previous occasions. to be led to a
9:21malware site or a site that will steal
9:23your personal information.
9:27In this page, we have a a look at a fake
9:30refund site. Um there is an equal
9:33quantity of sites that punish you in one
9:36hand and that other sites that offer a
9:38refund in this case uh coming from the
9:41IRS. The link here involved will lead
9:44you to a fake website asking you to fill
9:47out some very sensitive information
9:49including your social security number,
9:51data bar address, etc. which would of
9:54course would likely end up on the dark
9:56web uh marketplace. You find yourself
9:59into the category of identity theft once
10:01again.
10:03And now here in our last example, we
10:05have a Google Doc scam. So using this uh
10:09type of fishing email, attackers will
10:11send an email claiming to be a uh from
10:14Google um which is asking you to click
10:17allow to share information with Google.
10:20This um link redirects you to a fake
10:23Google login page where if you enter
10:25your credentials, scammers steal your
10:27login details and access your files.
10:30This is similar to the Dropbox login and
10:32some other uh personal storage sites. Of
10:35course, once they're in on your um
10:37personal files, they can find a lot more
10:40information um such as scanned
10:42documents, personal identity documents,
10:44and etc. You do have to be very careful
10:46in these things, particularly if it's
10:49unsolicited.
10:50[Music]
10:55Now, we move into our sming section
10:57where we'll cover three common examples
10:59of smishing and explain briefly what it
11:02is and how it works. So let's move on to
11:05the next slide.
11:09Smishing, as you may know, refers to
11:10fishing but using text messages over
11:14mobile networks. Smishing attacks are
11:16generally less sophisticated than email
11:18attacks as text messages are more
11:21limited in content, but they are similar
11:23in their ability to embed links and
11:25attachments in them, which can lead to
11:27identity theft, credit card fraud, and
11:30of course, other bad things. Network
11:32carriers such as Verizon, T-Mobile and
11:35AT&T do try to filter out these messages
11:38on their network networks, but new types
11:40of attacks do get through. Hence, they
11:43recommend that receivers forward
11:44unwanted text to the short code 7726,
11:48which is short for spam, to try and shut
11:50them down quickly.
11:57Some smitting messages are quite
11:59convincing. This fake FedEx message
12:01includes fake scans of an envelope and a
12:04message to reschedule a missed delivery.
12:07Many victims will be duped into clicking
12:09this link out of curiosity and not
12:11thinking about telltale signs of
12:13deception such as spelling mistakes, as
12:16you'll notice here in the URL where
12:17reschedule is misspelled. Readers of
12:20this text may also overlook the fact
12:22that there's no tracking number and the
12:25images are deliberately out of focus.
12:28This is of course to be taken in context
12:30that you were likely not expecting a
12:31package in the first place, which should
12:33be an immediate red flag. So, what
12:36should you do if your suspicions are
12:37aroused? Well, you should look up FedEx
12:40customer service number and internet and
12:42verify the delivery directly, but never
12:45through clicking on a link in the text
12:47itself.
12:52Here's an example of another smishing
12:54attempt. This time from Chase Bank. It's
12:57important to note that banks will never
12:58invite you to click on a link in a text
13:00message as they realize how inherently
13:03dangerous text messages are. It's always
13:05better to contact your bank uh via
13:07customer service number on the back of
13:09your debit or credit card on the
13:11internet if you're ever in doubt about
13:12these type of communications. Banking
13:15institutions will offer guidance on
13:17their own banking apps and online
13:18banking website portals giving more
13:21detailed guidance about what to do which
13:23you should pay attention to.
13:29[Music]
13:32Another recent phenomenon shown here is
13:35the rise of recruitment scam texts and
13:37emails which invite victims to apply for
13:40a fake job opportunity. The message
13:43sender will often interact with the
13:44victim to add credibility to the scam.
13:47But usually there will be some kind of a
13:48link in the text that leads people to a
13:50cloned website which collects a
13:53significant amount of personal detail
13:55placing the victims at greater risk of
13:57identity theft.
13:59[Music]
14:03Another frequently reported scam is
14:05called the fake toll scam which have
14:08been recorded all over the US. In this
14:11scam, attackers will use a fake
14:12lookalike link to a real toll authority,
14:15in this case, easy pass, along with an
14:18official sounding threat of penalties,
14:19including legal action, which could
14:21happen immediately if payment is not
14:23taken promptly or is not made promptly.
14:26The link in the text takes you to a page
14:28where you enter your bank or credit card
14:29info and your driver's license number
14:32along with other personal detail, which
14:34can be used to steal your identity and
14:36credit card information. The FTC,
14:38Federal Trade Commission, guidance here
14:40is similar to what I've said in previous
14:42slides. So, don't click on any links or
14:44respond to unexpected texts. Scammers
14:47want you to react quickly to this kind
14:49of thing. The FTC also says to check to
14:52see if the text is legitimate by
14:54reaching out to the state's tolling
14:56agency using a phone number or website
14:59you know is real and not the info
15:01provided on the text. And then finally
15:04to report and delete unwanted unwanted
15:07text messages. So use your phone's
15:09report junk option uh to report unwanted
15:12unwanted texts to your messaging app or
15:15forward them to 7726
15:18which is a short code for spam. Once
15:20you've checked it out and reported it
15:22then you can go ahead and delete the
15:23text.
15:31So in this last slide in our topic on
15:33smissioning uh we take a look at some
15:36statistics which I think are eye
15:37opening. So our first first statistic is
15:40that 76% of businesses were targeted by
15:43smissioning texts in 2024. That's up
15:46from 20% from the previous year in 2023.
15:49And for those businesses who were
15:51unfortunate enough to fall victim to an
15:53actual breach, well, it cost them on
15:55average $9.5 million when they factored
15:59in downtime, recovery, fines, and
16:01investigations.
16:03The road toll scams have surged a
16:05whopping 2900% between 2023 and 2024,
16:09which should be also seen as an
16:11indicator of how successful that that
16:13scam has become. While the last
16:15statistic shows us that Americans are
16:18inundated with spam despite the
16:20prevention efforts of carriers like
16:22AT&T, Verizon and T-Mobile. The carriers
16:25have tried to implement solutions as
16:26recommended in the previous slide by the
16:28FTP FTC such as forwarding spam text to
16:317726
16:33and other solutions such as centralized
16:36spam registries, SMS network filters
16:39which have worked to some extent but
16:41have not stopped ever more determined
16:43hackers who are now using artificial
16:45intelligence to quickly defeat controls.
16:51So in this section we're going to talk
16:53about another type of fishing attack
16:55which is known as farming. So farming is
16:57a type of attack which uh malicious code
17:00on your computer redirects users to
17:02fraudulent websites or manipulates their
17:05computer system to collect sensitive
17:06information. So you you may ask how does
17:09this type of attack happen? Well, it can
17:12be uh done through a number of ways such
17:14as visiting an a reputable website like
17:17a free software download site,
17:19downloading an email attachment or
17:21installing a browser plugin and some
17:23other methods. Much of the much of the
17:26time the design of the attack is to
17:28redirect users to a website which looks
17:31like a legitimate one such as a bank
17:32website, a social media site or an
17:35online marketplace site which we'll see
17:38uh covered in the next few slides.
17:45So here is an example of a fake bank
17:48site form. This case it's HSBC. This has
17:52successfully deceived thousands of users
17:54in the past. And uh hackers in this case
17:57registered a domain which was similar to
17:59the bank's uh legitimate address and
18:02would make it difficult to detect as a
18:04fraudulent uh site without further
18:06checks. The form here collects a
18:09significant amount of sensitive personal
18:11and credit card data which should almost
18:13certainly be used in fraudulent card
18:15activity and identity theft. Users need
18:18to be extra vigilant for unusual website
18:21addresses with showing several hyphens,
18:23missel misspelt words or nonsensical
18:27words. They need also to be vigilant for
18:30the site not secure messages which you
18:32see up here in the message bar. So as a
18:34matter of good practice, use uh the
18:37authorized site site website directly,
18:40the HSBC in this case website directly
18:43and don't access it through an email
18:45link.
18:47[Music]
18:52So this is an example of a fake social
18:54media notice. In this case, users will
18:57see a link in their direct messages
18:59which takes them to a form just like
19:00this. The form title is designed to
19:03alarm unsuspecting victims with an
19:05alleged violation and a threat of a of
19:07potential account deletion. This is an
19:10example of an attack which can be headed
19:12off if you stop and think it through. So
19:14what do I mean by that? Well, ask
19:16yourself why would the platform, in this
19:18case Meta, need to know information they
19:21already have on you? And why isn't there
19:23any detail on what the alleged violation
19:25was? and why is it appearing in direct
19:28messages as opposed to an official meta
19:30notification? Hence, always question why
19:33any unexpected request for information
19:35is happening in the first place. You
19:37have to think, could it be a scam for
19:40collecting my information for identity
19:41theft, etc.
19:52In this last example of a farming email,
19:55we see comes from the Geek Squad, which
19:58is a repair and technical support chain
20:00in the US. The ruse here is that you
20:03have been you have been automatically
20:04enrolled for another year in a
20:06subscription that you never enrolled in
20:08in the first place. This, of course, is
20:10designed to make a reader make a hasty
20:12decision in anger to fill out the form
20:14and dispute the charge. At this point,
20:17of course, they will have have your real
20:19car details ready for the taking if you
20:21fall for the trap. There many variants
20:23of this type of farming scam where
20:25different organizations are used as a
20:27ruse. Common ones I've seen are Norton
20:30Antivirus, Netflix, and Amazon Prime,
20:33which use a fake subscription or problem
20:35with the subscription approach.
20:39The last type of fishing we'll cover in
20:41this video is called fishing, which is
20:43similar to fishing and smishing, but it
20:46involves calling victims and using
20:48social engineering to persuade victims
20:50to provide personal information,
20:52typically with the goal of accessing
20:54financial data. The attacker will often
20:57use a ruse like they are a bank rep at
20:59their bank, law enforcement official,
21:02internal revenue officer, or even
21:04pretending to be from the department at
21:05your workplace. They often request
21:08information at some point in the
21:09conversation such as PIN numbers, social
21:11security numbers, credit card security
21:13codes, passwords, and other personal
21:16data. They may also ask to install
21:18software on your machine to diagnose
21:20some kind of a fake issue, which of
21:22course is highly likely to end up badly
21:24for the victim. They may use AI
21:27synthesized voices to mask the true
21:29identities and sometimes add in
21:31localized accents on the phone to add
21:34authenticity to the scam.
21:44In this graphic, we see a common fishing
21:46technique used by attackers and cyber
21:48criminal gangs. In step one, a cyber
21:51criminal obtains contact details of
21:53thousands of bank customers from lists
21:56being sold on dark web mark marketplaces
21:58like Stixs and Biden Cash, which are
22:01some of the largest sources for illegal
22:03personal data lists.
22:05The attacker will likely trim down the
22:07list to top targets based on customer
22:09age and socioeconomic data to improve
22:13their chances of scoring big. In steps
22:16two and three, the attacker calls a
22:17victim pretending to be a bank official
22:20and tries to convince them of the need
22:21to transfer money to address some kind
22:24of an urgent issue to avoid potential
22:26legal action or even account closure. In
22:29steps four and five, if the attacker
22:32manages to persuade the victim that the
22:34threat is real, they will provide
22:36payment instructions and ask the victim
22:37to log into their bank account on the
22:39phone and make the transfer to remedy
22:42the situation. Many of these attacks can
22:44lead to thousands of dollars and even
22:47entire IRA and 401k accounts being
22:50drained. So their pressure tactics, fear
22:53and attacker prepared responses can in
22:56intimidate unsuspecting v victims into
22:59following attacker instructions in order
23:01to rectify a some kind of a manufactured
23:03problem.
23:06So in this tech support vishing scam,
23:09attackers pose as tech support engineers
23:11who say that they've identified an issue
23:13on your PC that needs to be fixed. This
23:16is a common type of fishing scam and
23:18unfortunately is particularly targeted
23:20on older people who may be more
23:22vulnerable to fast-talking alarmist
23:24predators like these. In most cases, the
23:27scam results in the victim's bank
23:29account being accessed and fraudulent
23:31funds transfer being made to an overseas
23:33account. They may often claim to be from
23:36Microsoft or an antivirus company like
23:38Norton to add some credibility to the
23:40ruse.
23:43We mentioned CEO scams earlier in terms
23:46of email. In this type of vishing scam,
23:49an AI synthetic voice mimics a CEO or
23:53other executive and is used on
23:55conference calls or on voicemail
23:56messages to try and dupe employees into
23:59taking an action such as donating money
24:02to a fake charity.
24:04With the rise of AI generative
24:06technologies, the abilities for hackers
24:08to mimic voices and images of anyone has
24:11reached new levels. Some companies have
24:13reported successful attacks where AI
24:16generated CEO voices have been used to
24:19ask questions and collect highly
24:21sensitive information such as company
24:23earning data and other client
24:25information on conference calls.
24:28[Music]
24:30In these IRS type tax scams, an IRS
24:33official or tax advisor calls to claim
24:36that there is an urgent tax matter that
24:38needs to be addressed or face some kind
24:40of a penalty. These type of scams are
24:42usually conducted around tax filing
24:44deadlines to add some credibility and
24:47increased pressures on victims.
24:51So, in this last example of a fishing
24:53scam, a caller may call about a case uh
24:57about a bogus me medical claim which may
24:59be due to be paid out to you. The intent
25:01of course is to try and get personal
25:03data out of you such as social security
25:05numbers and bank information. So, this
25:08is another type of scam designed to
25:10steal your personal information which
25:12can be used to file false claims and
25:14even open fraudulent lines of credit
25:16later on.
25:22[Music]
25:24So, as we draw to a close, I've added uh
25:27some more government and well-known
25:28vendor resource links which may help you
25:31and your organization with the
25:33challenges of fishing. The link here is
25:35also available in the video description
25:37below for your convenience along with
25:39the 10 question quiz to test your
25:41knowledge on fishing.
25:44Well, congratulations if you made it
25:46here to the end of this training. I hope
25:48you found the content useful for you and
25:50your organization. If you did find it
25:53useful, I ask you to like and subscribe
25:55to the channel. I've also included my
25:58contact details if you'd like to discuss
26:00your cyber training needs. I'm currently
26:02running a 50% promotion offer the first
26:05training session for a limited time.
26:07Just use the promo code fishing to get
26:10the discount when you book. So, thanks
26:12again and I look forward to seeing you
26:13in the next video. See you then.

About this transcript

This page contains the full transcript of YouTube transcript (bNzN5eKY2rM) , generated from the public captions YouTube serves with the video. The transcript has 4,147 words across 638 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.