YT YouTube2Text

YouTube2Text → Transcripts → Phishing Awareness Training for Employees 2025 | Free Course

Phishing Awareness Training for Employees 2025 | Free Course — Transcript

by DPO Solutions (Paul Rogers Security) · 4,550 words · 749 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00Let's look at our six training
0:01objectives shown here on the screen
0:02before we dig in. So let's look at our
0:05six training objectives shown here on
0:07the screen before we dig in. So firstly,
0:10learners will understand what fishing is
0:12and what the composition of a fishing
0:14email looks like from the header right
0:16down to the
0:17footer. Then learners will gain an
0:19understanding of the six most common
0:21types of fishing and how they work in
0:23practice. Thirdly, students will get to
0:26understand what actual fishing emails
0:28look like through the use of some
0:31examples. Then learners will gain an
0:33understanding and awareness of the
0:34dangers of malicious attachments like
0:36PDFs, zipped files, office format files,
0:39and
0:40executables. Fifth, in our training
0:42objective, students will gain an
0:44understanding through the use of a
0:46recent example of the cost of a data
0:48breach in terms of money and reputation.
0:51And then lastly, learners will become
0:53aware of six preventative steps that
0:55they can take to avoid fishing and
0:57identity theft at at work and in the
1:00home. So let's move on to the index on
1:02the next
1:06slide. So let's cover the index for our
1:09course. We start out by covering what is
1:12fishing and its impact on business. We
1:15look at the largest fishing incident of
1:172024 involving a healthcare provider and
1:20how it happened. We then look at the
1:22core part of this course which covers
1:24the six most common types of fishing out
1:27there. We examine three common parts of
1:30a fishing email i.e. the header, body
1:32and footer and how fishing can be
1:35identified in each
1:36section. We cover spear fishing in
1:39detail along with social media fishing
1:41and virtual meeting threats.
1:44And we then cover what smishing is and
1:47look at six practical steps for
1:49preventing fishing and three ways to
1:51prevent personal identity theft. We then
1:55round out the training with a graded
1:57quiz risk recap and some external links
2:00to help you dive deeper into some of
2:02these topics if you wish. So now we'll
2:06head on to lecture one in the next
2:08section.
2:24So let's start the main part of the
2:25course by asking the question, what is
2:28fishing and what are fishing attacks?
2:31Fishing attacks are a type of social
2:33engineering where an attacker sends a
2:35fraudulent message designed to trick a
2:37person into performing an action which
2:39benefits the
2:41attacker. This could be to get the
2:43victim to reveal sensitive information
2:45such as bank details, passwords, or
2:48allow malicious software to be installed
2:50on the victim's computer, which is
2:52something we commonly see with
2:54ransomware attacks.
2:56Fishing is commonly associated with
2:58links in emails, meeting invites, text
3:01messages, and social media direct
3:03messages, which entice users to click on
3:06them. These attacks are designed to get
3:09the reader attention and evoke a fast
3:11response from users without them really
3:13thinking about it.
3:15Some of the malicious emails can be very
3:17difficult to distinguish from real
3:19emails as they often use familiar logos,
3:22names, and email design to make them
3:24look authentic. However, there are
3:27so-called tells which can indicate
3:29fishing such as poor spelling, odd tone
3:32and content, and unusual email
3:35timestamps perhaps indicating the
3:37foreign time zone of the attacker. We'll
3:41look at the three parts of an email
3:42construction in upcoming slides which
3:45can help you identify possible fishing
3:52emails. Fishing attacks have increased
3:5550% over the last four years across the
3:58globe, partly in response to increased
4:00remote working and the advent of
4:02artificial intelligence driven hacker
4:05tools. Experts now estimate that around
4:083% of all email sent each day around the
4:11world is malicious, carrying payloads
4:14such as malware attachments and links
4:16which are causing millions of dollars in
4:19damage. Ransomware and fishing are
4:21practically synonymous today as fishing
4:24attacks are the primary cause behind
4:26ransomware infections.
4:28Ransomware, as you may know, is
4:30typically downloaded through malicious
4:31links and emails where it can then
4:34infect network devices and go on to
4:36steal valuable information and encrypt
4:38business and personal
4:40data. Information which is encrypted can
4:43only be decrypted when a ransom is paid
4:45and a decryption key is exchanged
4:47exchanged by the cyber criminal.
4:50Much of the time this hijacked data is
4:53sold on the black market whether the
4:54ransom is paid or not in a further
4:57attempt to generate illegal monetary
4:59gains. All of this of course can
5:02severely affect businesses in terms of
5:04cost, loss of confidential
5:06confidentiality and reputational damage.
5:09The FBI estimates that ransom demands in
5:122024 average $5.3 million while there
5:16were over $236 million ransomware
5:19attacks recorded last year. Part of the
5:22cost of ransomware attacks stem from the
5:25cost of
5:26investigations, legal actions, business
5:29interruption, lost revenue, staff
5:32training, audits, and new technology
5:34required to prevent future attacks.
5:37Often all of this is ju is a result of
5:40just one click on a malware link in an
5:42email by an unsuspecting
5:47user. In this slide, we look at the
5:50largest breach in the US in 2024 which
5:54led to a staggering onethird of the US
5:56population being exposed to a healthcare
5:59breach which was reported on February
6:0121st, 2024.
6:03Basically, an employee at Change
6:05Healthcare, which is based in Tennessee,
6:08clicked on a malicious email link which
6:10triggered a ransomware attack that led
6:12to their systems being inaccessible and
6:14over a 100 million records being stolen
6:16by a ransom ransomware gang known as ALV
6:20ALPHV
6:23uh/blcat. So, here's a little more
6:25detail drawn from Wikipedia on the
6:27breach so you can get a better picture
6:29of what really happened.
6:31Wikipedia said the impact was profound
6:34to the healthcare organization as the
6:36disruption prevented payouts to doctors.
6:39Uh while electronic payments and
6:40Medicica claims could not be processed
6:43by their parent United Health Group,
6:45patients were forced to pay for many of
6:47the medications out of pocket instead of
6:50using medication coupons or co-pays.
6:52Many healthcare providers claim to lose
6:54significant revenue as a result of this
6:56the disruption up to hund00 million per
7:00day threatening many with insolveny as a
7:03result of the cyber attack. Human health
7:05service services opened a civil rights
7:08investigation with regards to patient
7:10privacy concerns. On February 22nd,
7:142024, United Health Group filed a notice
7:17to the Securities and Exchange
7:18Commission stating that a sus suspected
7:21nation state associated uh cyber
7:23security threat actor gained access to
7:26change healthc care's information
7:28technology system. Following United
7:32Healthcare Group's initial filing, CVS
7:35Health, Walgreens, Publix, Good RX, and
7:39Blue Cross Blue Shield of Montana
7:41reported disruptions in insurance
7:43claims. The cyber attack affected
7:45family-ownedies and militaryies,
7:48including Naval Hospital Camp Pendleton
7:50and the healthcare company Athena
7:52Health, which was also
7:54affected. On March 4th, 2024, rep
7:58Reuters reported that a Bitcoin payment
8:01equivalent to nearly $22 million had
8:04been made to a crypton cryptocurrency
8:06wallet associated with the cyber gang,
8:08the Alpha V cyber gang. Uh, United
8:11Health who who paid the ransom, did not
8:14comment uh on the payment.
8:17So as of April 16th last year, United
8:20Health Group had advanced payments of
8:23over whopping $6 billion in assistance
8:26to health care providers affected by the
8:28cyber security
8:29attack. So hopefully you'll see from
8:32this episode something of the scale of
8:34the damage that can be caused by a
8:36simple click on an email.
8:47fishing types. So before we delve into
8:50actual examples of fishing, we need to
8:52look at the different types of fishing
8:54out there. On this slide, we see six
8:57common types of fishing starting with
8:59your garden variety email fishing. So,
9:02email fishing usually involves a generic
9:05email sent out indiscriminately to
9:08company email domains or large groups of
9:10people on a mailing list. These types of
9:14fishing operate without any particular
9:16knowledge of the intended victim and
9:18often don't even include the addressy
9:20name or real information like valid
9:23account numbers or other personal
9:26details. Next on our list is spear
9:28fishing. This is a more targeted form of
9:31attack where known details about a
9:34recipient are used to get their
9:35attention encourage and encourage them
9:38to act. So this could be an email with a
9:41person's banking institution an banking
9:44institution, favorite sports team, car
9:46brand or interest that's likely to draw
9:48the reader
9:49in. Next we have whaling. Whailing is
9:53similar to spear fishing but focused on
9:55targeting senior executives in the
9:57company often with the objective of
9:59authorizing fund transfers or gaining
10:02special access to sensitive information
10:05like company financial data and
10:07personnel information.
10:09Next is vishing or v i sh h i n g where
10:14you get voice or voice IP calls or voice
10:17messages which are used to attack
10:20victims such as voicemails with
10:22instructions to call your bank because
10:24of a security issue or some other
10:26fraudulent reason which requires urgent
10:30attention. Next is smishing. This
10:33essentially is fishing but uh based on
10:36mobile text or SMS messages. This is
10:39similar to email fishing in that there
10:41are malicious malicious links and text
10:43designed to get you to act quickly but
10:46obviously on a mobile
10:48platform. And last on our list is SEO
10:51fishing or search engine optimization
10:53fishing. This is slightly more
10:55sophisticated and involves the
10:57manipulation of search engine results.
11:00In this attack, cyber criminals use
11:02search engine optimization on a cloned
11:05or lookalike website to appear as a top
11:08result or near to the top result on a
11:10search engine. This might look like your
11:13online banking site login page, but in
11:16fact uh it could be a page designed to
11:18steal your login details.
11:30In this slide, we see the structure of a
11:33fishing email which includes a header,
11:35body, and footer. In this example, we
11:38look at a email from Best Buy
11:41electronics retailer. And if you were a
11:44customer of them, you might be alarmed
11:46at an unexpected charge and may be
11:48tempted to open the attachment or click
11:50on a link to find out more. But of
11:53course, this is what attackers are
11:54hoping for. So, let's take a look in the
11:56next slides what you can do to detect
11:58this kind of
12:08fraud. In this slide, we're looking at
12:10the email header and the red flags uh
12:13that we show here blinking in red dots.
12:16So when emails come in in unexpectedly
12:18or with content conveying a sense of urg
12:22urgency or allude to an attractive
12:24offer, it's time to raise your
12:26attenerate for a possible fraudulent
12:28email. In our example here, there are
12:31three points of note. The email in this
12:34case from Best Buy was sent to my work
12:37email. If it were real, it probably
12:40should have gone to my personal email as
12:42that's where I have the account with.
12:44Two, there's a PDF attachment. Um, that
12:48would be a bit suspicious as a it's a
12:50hacker's favorite technique. I using
12:53attachments such as invoices or um other
12:56types of uh documents to draw you in.
12:59Three, the time the email was sent was
13:02early in the morning, out of business
13:04hours uh for my time zone. That would
13:06also be a red flag. So, what we're
13:09saying here is to stop, think, and
13:12decide. When you see an email that comes
13:14in like this, stop in that. Look at who
13:16is sending the email. If it's an
13:19external email, um, is it unusual that
13:22they should be it's it is unusual that
13:24they should be sending an email to your
13:26work email. Um, are there any
13:28attachments? Well, think about that.
13:30Don't open them. If there is a lease
13:33suspicion of the threat, look at the
13:35timestamp. Is it out of office hours?
13:38This could be another sign of a fake
13:39email. And then finally, decide. Use
13:42your judgment. Be careful as to
13:45determine whether it's safe to keep
13:46reading the email and report it, of
13:48course, if you do have any
13:59suspicions. Here we take a look at some
14:01actual email attachment examples which
14:05were designed to lure people into
14:07opening opening them. Packers will use
14:10authoritative and trustworthy sending
14:13sender names such as government
14:14agencies, household names such as
14:16Amazon, Apple, and of course, household
14:19bank names like Chase and Bank of
14:21America. Hackers are working on the
14:24psychology of the reader who is more
14:26likely to recognize the name and trust
14:28what's
14:29enclosed. This is akin to the psychology
14:32of having a trusted relationship with
14:34the sender, which hackers, of course,
14:36are looking to
14:37exploit. It's also more likely that
14:39readers will have an existing account
14:41with Apple Amazon which they may be
14:44inclined to click on a link to check out
14:46of concern that that there may be some
14:48kind of a problem. Hackers use an array
14:51of common file formats uh including the
14:54PDFs we see here but also zipped files,
14:57image files, text files, scripts and
15:01spreadsheet formats as attachments. So,
15:03generally speaking, keep your guard up
15:05when any emails come through with
15:07attachments and assume that they're
15:16unsafe. Now, let's look at the body of
15:19the email. In this example, we have two
15:22suspicious elements to bring your
15:24attention to. The first is a spelling
15:27mistake which is ev evident here on the
15:29first line of the email with this
15:31misspelling of the word
15:33enclosed. Spelling mistakes are often an
15:36indicator of foreign threat actors with
15:38poor literacy skills who create these
15:40kinds of emails. The second important
15:43point is the actual click clickable link
15:45in blue which looks like a legitimate
15:48link to the Best Buy website. It's
15:50crucial not to actually click on this,
15:52but you can merely hover over it with
15:55your mouse instead if you're not sure.
15:58In this case, we see a lookalike
15:59malicious website, uh, Best Buy, spelled
16:02with no e, so it's bsty.com,
16:06uh, which could be used to download load
16:09malware onto your machine.
16:11It's very common for hackers to use
16:13similarly spelled links and names to dup
16:16busy employees into not into not
16:18noticing the subtle differences between
16:21the legitimate and malicious
16:31emails. And now we take a look at the
16:34last part of the email structure, the
16:36email footer.
16:38So the email footer has a general per
16:41purpose of adding visual credibility to
16:43the email with things like corporate
16:46sending text, logo, search box, and
16:49social links that are all similar to a
16:51real email from, in this case, Best Buy.
16:55The combination of all these sections
16:56can make a compelling looking email.
16:59Hence, many email users are deceived
17:01into trusting that the email is real and
17:03clicking on the enclosed malicious
17:05links. You may be a asking why these why
17:09aren't these types of emails blocked by
17:11firewalls and filters. The answer is
17:14most are but hackers use automated tools
17:17and in methods to bypass controls such
17:20as sending emails from trusted domain
17:23names and by using volume and variation
17:27of emails a lot of them do end up
17:29getting through to the end
17:33user. So the next uh area of fishing
17:36that we want to talk about is spear
17:38fishing. So what is spear fishing? Well,
17:41it's a specialized form of fishing where
17:43hackers pursue a particular person or
17:45small group that they feel may be more
17:48exposed or may have more to gain if
17:51they're successful in hacking. This
17:54could include people like employees from
17:55the finance or HR department where
17:58access privileges to money and personal
18:00information are at a higher level. Hence
18:03with these type of fishing emails,
18:05hackers will craft emails with ro
18:08related terms such as overdue invoice,
18:11company filing
18:13deadline, employee termination
18:15notification, which are all
18:17time-sensitive terms and more likely to
18:20draw a finance person or HR person into
18:22clicking a link h or trying to get them
18:26to authorize something that they
18:27shouldn't.
18:28One variation of spear fishing is known
18:31as CEO fraud, which target targets
18:34authorized employees with the ruse of
18:36asking them to do something urgently
18:38like approve a funds
18:40transfer. The email looks to be from the
18:43CEO of the company which lends lends
18:45false authority to the
18:47request. Of particular value to spear
18:50fishers are employees with financial or
18:52management roles who more likely to have
18:54access to sensitive information or the
18:57ability to transfer funds more easily
18:59within
19:01organizations. In all these situations,
19:03email users need to stop and evaluate
19:06the probability and telltale signs of
19:08fraud as previously shown.
19:23So in this chart we give you a quick
19:25snapshot of favorite targets of hackers
19:28when they use spear fishing. We see on
19:31this list roles which are commonly in
19:33the crosshairs of hackers including
19:35network and system administrators which
19:37we've seen here in the first step. This
19:39is because of their elevated account
19:41privileges which would allow hackers
19:44greater powers if they
19:46compromised. The next three steps show
19:48you three different roles which spear
19:50fishers frequently target within
19:52organizations. They include finance
19:54department personnel, HR staff, and
19:56company executives.
19:59The reasons that these roles are
20:00attacked relate to their ability, if
20:03compromised, to approve financial
20:05transactions, access personnel
20:08information, and confidential
20:10information within
20:11organizations. All of this type of
20:13information could be used for scams such
20:15as invoice redirection fraud, identity
20:18theft, and ransomware attacks. On the
20:21top step here of the graphic, we see the
20:23CEO role itself. The CEO is the most
20:27important role within an organization
20:29and as such conveys implicit power to
20:32the staff. For hackers, impersonating
20:34the CEO in fishing or even AI generated
20:38voice recordings can often deceive other
20:40staff into taking action without
20:42thinking in an effort to comply with the
20:45the boss. And if the boss sends out an
20:47email or something, the much more likely
20:49that the employee will take action and
20:51take
20:55notice. Social media fishing and hacks
20:57are just as rife as email fishing and
21:00tend to be much more focused on personal
21:02identity theft, running up fraudulent
21:04charges on credit cards that may be
21:06linked to your account along with other
21:08malicious reasons. Many of the attacks
21:11have components which are designed to
21:13make you believe that you violated a
21:14platform policy and that you need to
21:17unlock your account. Other links may
21:19entice you to enter a competition or
21:21click on a link to get access to a
21:23premium feature for free or even connect
21:26with the fake profile through a direct
21:27message to access your profile. So what
21:30should you do? Well, similar to email
21:33messages, pay attention to those sending
21:35the email and ask the questions as to
21:37whether it could be malicious,
21:40particularly if it's
21:41unexpected. Contact the platform
21:44provider like Meta, Tik Tok, or X
21:46through the official help area if you
21:48have any doubts. Unsolicited direct
21:51messages. Direct messages are generally
21:53a bad thing, particularly if there are
21:55links involved. So, be
21:58careful.
22:08Continuing on from the last slide, we
22:10break down the most common social media
22:12threats, but this time in graphical
22:15form, some of which we've discussed in
22:17the last slide already. Starting from
22:20the right, we see fishing attacks
22:21related to account notices from
22:23platforms like Meta X and Tik Tok, which
22:25we've mentioned, where they use terms
22:28like your account is locked due to a
22:30platform violation, or your password
22:32needs to be reset to continue using the
22:35platform. Next, we see the dangers
22:37associated with fake profiles being used
22:40to impersonate friends or well-known
22:42companies like Amazon or eBay.
22:46Frequently, hackers will leverage AI to
22:49generate profiles which are real
22:51realistic looking and look to built up a
22:54social media connection list making them
22:56seem more
22:58authentic. The others on the list
23:00include unsolicited direct messages with
23:02links, giveaways, fake third party apps,
23:05and fake news with sensational stories
23:08or AI generated images. It's important
23:11to note that these are only six of over
23:14a dozen fishing type scams which plague
23:17social media today. While while the
23:20platforms such as Meta and Tic Tac offer
23:22ways of combating these problems through
23:25two factor
23:26authentication, privacy setting and
23:28security checkup tools, it's not
23:31infallible as 90% of the time it's up to
23:33the user to be vigilant, which of course
23:36is your responsibility.
23:40So here we take a look at some of the
23:42virtual meeting attack types. Hackers
23:45have been known to launch various types
23:47of attacks on video and voice
23:49conferencing such as Zoom, Teams, and
23:52WebEx. One of the most common ones is
23:55fake lookalike meeting links that are
23:57hard to distinguish from the real ones.
24:00Hackers may send out meeting requests
24:02with links that are very close in
24:03spelling to the real thing, but lead to
24:06a malicious site instead.
24:08Once you click on the malicious link, a
24:10number of attack types may happen,
24:12including allowing the hacker to join
24:14and listen in on confidential
24:16discussions. Disrupt a meeting by Zoom
24:18bombing or creating fake login screens
24:21to steal credentials from a victim. Once
24:24again, it's important to doublech
24:26checkck meeting links by hovering over
24:28the links before clicking on them and
24:30not sending out administrator pins and
24:32emails. It's also good practice to lock
24:35the number of participants in a
24:37conference and rotating meeting join
24:40information regularly so that hackers
24:42are less likely to get
24:47in. SEO or search engine optimization
24:51fishing is a slightly more sophisticated
24:53type of attack designed to deceive
24:56people who are searching for legitimate
24:57services on the web.
25:00An example of this might be a fake
25:02online banking website which looks the
25:04same as a legitimate one and shows up on
25:06the first page of Google search results.
25:09As we can see in our sample graphic
25:10here, as a normal user, it's very
25:13difficult to know the difference from
25:15first glance as users will routinely not
25:18look too hard at the web address,
25:20particularly when they are so similar to
25:22the real thing. Once a user clicks on
25:25the fake link, they will be presented
25:26with a clone site, which prompts you to
25:29enter your banking login details, which
25:31is what they're really
25:33after. Unfortunately, by the time
25:35complaints are made and actioned by
25:36Google, much damage can be already be
25:39done. And we regularly hear accounts of
25:43being drained of funds with this type of
25:45attack. The only real defense against
25:48this is vigilance when using the web and
25:50using anti-malware browser plugins from
25:54reputable sources like Macaffy, Sofus,
25:57and
26:02Microsoft. In the final attack type
26:04we're covering here is smishing or text
26:07fishing. This is very similar to email
26:10fishing, but can be harder to detect
26:12sometimes due to the lack of detail in
26:14the text messages other than a short
26:17message and a link. Much of the time,
26:19these texts look to be coming from
26:21legitimate numbers and service providers
26:23like UPS, Netflix, Amazon, or well-known
26:27banks and contain time-sensitive and
26:29account alert messages. It's quite
26:32common to see messages like you have a
26:34package delivery delivery or there's
26:36some kind of problem with your account
26:38or unexpected charge which needs to be
26:41rectified by clicking on the link. In
26:44all these cases, check with the provider
26:46directly through their website or phone
26:48support if you're not sure. Banks will
26:51never ask for credentials generated
26:52through a text message link.
27:00So in this slide we look at six ways of
27:02preventing
27:03fishing. So while it's impossible to
27:06completely stop fishing and its effect
27:08there are steps you can take to
27:09significantly reduce the risks. The one
27:13be alert for external emails with links
27:15emails with particularly emails with a
27:18sense of urgency and links to free
27:20offers or something that's too good to
27:22be true.
27:24Second, set a second form of
27:26authentication known as two-factor
27:27authentication for all of your online
27:30accounts. Three, be careful of social
27:32media direct messages with the links,
27:34particularly ones relating to alerts
27:36about your account or free
27:39offers. Fourth, avoid using your work
27:42email for personal reasons such as
27:44nonwork related online subscriptions and
27:47forms. Hackers can harvest your work
27:49email and passwords in an effort to
27:51attack your device and company
27:54systems. Five, set strong passwords for
27:57all your accounts and change them
27:59regularly. Use an approved password
28:01manager and password generator as
28:04appropriate. Lastly, be careful about
28:06installing browser extensions and third
28:09party apps on your devices. Use only
28:11trust trusted add-ons from reputable and
28:14verified
28:15sources.
28:19Identity theft is a top risk which
28:21involves hackers stealing your
28:23information through fishing and other
28:25means which can lead to very damaging
28:28consequences. These consequences may
28:30include fraudulent charges on your
28:32credit card, negative impact on your
28:34credit score, false insurance claims,
28:36and even police action. So, here are
28:39some things you can do to limit these
28:41effects. One, restrict access to your
28:44credit reports. Credit reporting
28:46agencies such as Equifax have tools
28:48which allow you to place a security
28:50freeze and fraud alert on your credit
28:52report. The former restricts access to
28:55your credit report while the latter
28:56sends out a notification when someone
28:59tries to open a credit line of credit in
29:01your
29:02name. Then avoid card transactions over
29:06public Wi-Fi. Card numbers and other
29:09personal data may be vulnerable to
29:11interception by wireless eve drops
29:13eavesdropping over public Wi-Fi
29:15networks. This means hackers can read
29:18card data when you're connected to Wi-Fi
29:20in areas such as coffee shops and
29:24libraries. Also, think about regularly
29:27reviewing your bank statements and
29:29ordering your free credit report
29:31annually to review suspicious activity.
29:34Another thing to think about is an
29:36identity theft protection service. These
29:39are ser several services which are
29:41subscriptionbased which offer alerts for
29:43social security number abuses, social
29:46media account monitoring, credit bureau
29:49monitoring and identity theft
29:50restoration
29:54services. So now it's time for a quick
29:56quiz with four questions covering the
29:59topics we just discussed. Be sure to
30:01click the next button when you've
30:02answered each one
30:09correctly. A type of fishing which uses
30:12texting is called Watt. Please choose
30:14your
30:23answer. How many common types of fishing
30:26are there? A 18, B 6, C 28, D 8, E F or
30:36F
30:487. Question three, which one of these is
30:51an example of good practice for
30:53preventing fishing? one, opening PDFs
30:56from untrusted external sources,
30:59forwarding suspect attachments to
31:01colleagues, avoiding public Wi-Fi
31:03connections, or disabling multiffactor
31:19authentication. Question four, final
31:22question. The average ransom demand made
31:25in 2024 was A $3.3
31:29million, B $5.3 million, C
31:35$110,000, or D $600,000.
31:49And now as we conclude this fishing
31:50awareness course, we'll leave you with
31:52the risk recap so that you're better
31:55prepared in the workplace and at home
31:56for telltale signs of
31:58fishing. So look out for attachments and
32:01emails particularly from external
32:03sources. Also look out for telltale
32:06signs of fishing such as a sense of
32:08urgency or odd tone in the email. The
32:12time of day when the email was sent is
32:14also important.
32:16Lastly, on the security precautions side
32:18of things, be sure to hover over
32:19external links rather than click on them
32:22to check their veracity, particularly
32:23from external emails. Use multiffactor
32:27authentication and strong passwords on
32:29your accounts and avoid public Wi-Fi
32:32connection connecting connectivity
32:34rather. Consider using credit reporting
32:37alerting services on your accounts as an
32:40extra precaution against the identity
32:42theft. So be careful out there and
32:45thanks for taking part in this course.
32:47Thank you again.
33:16[Music]

About this transcript

This page contains the full transcript of Phishing Awareness Training for Employees 2025 | Free Course by DPO Solutions (Paul Rogers Security), generated from the public captions YouTube serves with the video. The transcript has 4,550 words across 749 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.