保护您的账户免受网络钓鱼攻击

网络钓鱼一词指涉及虚假网站和电子邮件或其他消息的身份盗窃诈骗。网络钓鱼攻击的目的是获取您的账户和敏感信息的访问权限。攻击者可能模仿声誉良好的网站来创建自己的网站，或向您发送似乎来自可靠来源的消息。网络钓鱼消息可能来自虚假账户或已被黑客攻击的账户。

备注：如果您认为自己通过可疑渠道共享了个人信息，并且您的信息和身份面临风险，请遵循政府指南执行操作。

网络可能会要求您完成以下任务：

• 访问链接。

• 下载文件。

• 打开附件。

恶意软件 — 蠕虫、木马程序、僵尸程序和病毒等恶意软件 — 会在您执行任何以上操作时感染您的计算机或移动设备。感染设备后，入侵者便可以访问您的个人信息。

网络钓鱼诈骗可能还包括直接请求个人信息（如银行账户凭据）。

网络钓鱼诈骗可能会要求您提供以下个人信息：

• 通过电子邮件或其他消息传送系统。

• 通过表格。

• 欺诈性的电话号码。

• 通过伪造的真实地址。

即使要求您输入电子邮件地址和重置密码也可能是危险的。

备注：将您收到的任何网络钓鱼邮件转发至 的安全收件箱，地址为 safety@shopify.com。通过建立商家所受攻击的记录，Shopify 可以更好地保护您和您的信息。

认识警告标志

您可以通过了解警告标志来防范网络钓鱼。无论显示的发件人是谁，都要仔细阅读邮件；无论网站看起来多么熟悉，都要仔细检查。

过于笼统的语言

虽然网络钓鱼可能经过深入研究并针对您和您的企业进行定制，但笼统的语言是网络钓鱼诈骗的标志。如果邮件看似来自您信任的组织但是以模糊的语句开头，比如尊敬的账户持有者，请保持警惕。

同样，假如某封邮件向您承诺有千载难逢的商业或财政机会，但却未提供足够的详细信息让您能够确认发送者认识您，那么这也可能是诈骗：

我是 Frederick，一名银行家。请尽快就可能已故亲属的遗产与我联系。我无法通过短信分享太多信息。请通过以下地址给我发送电子邮件。

个人账户中的商业信息

丰富的攻击者可以通过您的在线业务收集充足的信息，从而创建看似来自真实联系人的邮件：

批发价格更新

您好，Georgia，我想向您提供最新资讯。这是我们当前批发价格的电子表格：fabric-prices-2016-oct.xls

希望您对上一批衬衫满意!如果您有任何问题或疑虑，请与我们联系。

--

Julia Chan

客户经理

示例形式

为发送攻击，他们会侵入您的联系人的企业账户或创建虚假的个人账户。例如，如果您的联系人 Julia 的个人电子邮件用户名为 juliachan3857，攻击者可能会使用用户名为 juliachan9665 的账户发送电子邮件。这种攻击形式依赖于两方面的因素：

• 人们会不小心用错误的账户发送电子邮件。

• 即使您知道 Julia 的个人电子邮件地址，但您也许不会仔细查看。

拼写错误、语法错误、样式多变

犯罪分子并不像专业的网络内容撰稿人那样认真对待内容风格指南。除了拼写错误和语法错误，在一个页面中出现以下类别的变化形式也可能表明是欺诈网站：

• 拼写。

• 大写。

• 编号。

• 标点。

• 格式。

危言耸听或过于激动的语气

当心时间紧急的请求，这些请求企图通过威吓使您不假思索地采取行动。例如，Shopify 不会向您发送包含以下内容的消息：

我们遇到了异常严重的服务器故障。在 24 小时内回复您的用户名和密码，否则您将永久无法访问您的商店。

同样，注意那些看起来好得令人难以置信的优惠信息，例如只有您立即参加才能获得旅游公司 90% 的折扣。

看起来不正确的 URL

网络钓鱼尝试可能包含看起来合法的 URL，不仔细查看将无法发现。许多网络钓鱼尝试使用故意选择的 URL，它们类似于您熟悉的 URL。如下表所示，如果您通常通过合法 URL 从 Example Apparel 购买游泳衣，并且您收到一封带有虚假 URL 链接的电子邮件，您便可分辨出这是一次网络钓鱼尝试。

真实的 URL 会将您引导至属于 Example Apparel 的域名 example-apparel.com 中的网站，而虚假 URL 会将您引导至可能为犯罪分子所有的域名 com-aquatic.net 中的恶意网站。

使用其他沟通方式提出疑虑

亲自对话或通过电话与可能发送可疑信息的人交谈，并通过与组织中的某人交谈来解决对网页的担忧。

如果您通过电话联系发件人，请拨打已存档的号码或出现在多个信誉良好的在线来源上的号码。例如，如果您通过电子邮件收到来自税务代理机构的可疑信息请求，请拨打去年纳税申报表上的电话号码。请勿拨打可疑网站或电子邮件中显示的号码。

The term phishing describes identity theft scams involving phony websites and emails or other messages. The goal of a phishing attack is to gain access to your account and sensitive information. An attacker can create their own website that mimics a reputable one or send you a message that seems to come from a trusted source. Phishing messages can come from a fake account or an account that has been hacked.

mises an important business or financial opportunity but doesn't include enough detail for you to confirm that the sender knows you, then it might be a scam:

I am Frederick, a banker. Pls contact me asap regarding a possible late relative's inheritance. Can't share much via sms. Email me at the address below.

Business messages from personal accounts

Sophisticated attackers can gather enough information from your online presence to create a message that could plausibly come from a real contact:

Wholesale Pricing Update

Hi Georgia, I just wanted to update you. Here is a spreadsheet of our current wholesale prices: fabric-prices-2016-oct.xls

I hope you were satisfied with the last batch of shirts! Please let me know if you have any questions or concerns.

--

Julia Chan

Account Manager

Example Fabrics

To send an attack, they can hack into your contact's business account or create a phony personal account. For example, if the username for your contact Julia's personal email is juliachan3857, then an attacker might send an email from an account with the username juliachan9665. This form of attack depends on two tors:

• People send emails from the wrong account by mistake.

• Even if you know Julia's personal email address, then you might not look too closely.

Misspellings, poor grammar, and style variations

Criminals don't take content style guides as seriously as professional web content writers. As well as typos and grammar errors, variations in the following categories within a single page can show that a website is fraudulent:

• spelling.

• capitalization.

• numbers.

• punctuation.

• formatting.

Alarmist or overexcited tone

Watch for time-sensitive requests that try to scare you into acting without thinking. For example, Shopify won't send you a message saying:

We've had a catastrophic server failure. Respond with your username and password in the next 24 hours or you'll lose access to your store permanently.

Similarly, watch for messages making offers that seem too good to be true, such as a 90% discount from a travel company available only if you act now.

URLs that don’t look right

Phishing attempts can include URLs that appear legitimate if you don't look too closely. Many phishing attempts use URLs that have been deliberately chosen to resemble a URL that you're already familiar with. As shown in the table below, if you normally buy swimming attire from Example Apparel at the legitimate URL and you receive an email with a link to the fake URL, then you can tell that it's a phishing attempt.

The real URL directs you to a site at the domain example-apparel.com, which is owned by Example Apparel, and the phony URL directs you to a malicious site at the domain com-aquatic.net, which is likely owned by criminals.

Raise concerns using another mode of communication

Speak to the supposed sender of a suspicious message in person or over the phone and resolve concerns about a webpage by talking to someone at the organization.

If you contact the sender by phone, then use a number you have on file or that appears on multiple reputable online sources. For example, if you receive a suspicious request for information from your tax agency by email, then call the agency at the number on last year's tax return. Don't call a number that appears on a suspicious website or email.

特别声明：以上文章内容仅代表作者本人观点，不代表ESG跨境电商观点或立场。如有关于作品内容、版权或其它问题请于作品发表后的30日内与ESG跨境电商联系。