- [Instructor] A couple of years ago, while on a flight,
I was sitting next to this lovely Asian couple from Texas.
When they found out that I worked in cybersecurity,
the woman's eyes lit up in recognition.
She talked about how she'd received a call a few weeks ago.
She said the call was a recorded message,
but it was in Chinese.
She didn't know what the call was saying and hung up.
She shook her head in frustration
and told me, "I don't even speak Chinese."
Some phishing attacks target specific groups of people
who speak a certain language.
In this case, the attack was unsuccessful
because the woman didn't understand the language.
If she was able to speak Chinese, however,
this attack could have had a chance at being successful.
We've gone over the dangers of phishing via email.
Some of you may even have the act of spotting a phish
down to an exact science,
but these days, phishing isn't limited to email.
Vishing as a voice-based phishing attack.
It can be harder to set up
than email-based phishing attacks,
but it's still effective for those of us
who answer calls from unknown numbers.
There was a job I had as a network analyst
for a security company.
We took calls from customers
to assist them with their networking-related issues.
One day, I got a super interesting call
from a man named Milo.
Milo told me he was the director of a team
I hadn't worked with before.
He had a British accent and claimed to work
in our UK location.
The story was that Milo was rushing to attend a meeting
at the New York location,
but his luggage hadn't made it on time and was delayed.
He told me that his work laptop and his work phone
were inside of his luggage.
He was calling to get in touch with another director
to let them know that he'd be running late.
When I offered to relay the message,
Milo said he had other things to discuss with this person
and he needed to speak with them directly.
At this point, I was in full-on resolution mode.
I wasn't thinking about how strange it was
that Milo made the choice to put his work phone and laptop
in his checked luggage.
That was a direct violation of our travel process
and as a director, Milo should be aware of the rules.
I look the person of interest up in our company directory
and prepared the call for transfer.
Right before I transferred the call,
my suspicion caught up to me
and I asked to place Milo on hold.
I messaged the person of interest
and I asked them if they were expecting
to meet with someone named Milo that day.
The director told me that he was
supposed to meet with Milo that day
and that Milo was standing right next to him.
I was floored.
The director told me to ask the fake Milo
what his wife's name was
as a way to prove who he was.
So I did, and the fake Milo said,
"Why would he ask me that?
"That is so strange.
"Well, I'll try another way to get in contact with him,"
and hung up.
Sometimes, vishing calls can be performed
by an actual person, like my run-in with fake Milo.
Other times, vishing calls are performed
by recorded messages asking for information
or requesting a call back,
like the Asian couple experienced.
A popular robocall scam is one in which the IRS calls
and asks for payment of any kind for a number of reasons.
In actuality, government agencies will not call,
text, or email to ask for money,
so these are always a scam.
By now, you're probably thinking that you're safe
if you only answer the phone
when you recognize who's calling.
Unfortunately, numbers can also be spoofed.
Caller ID spoofing is the process
of changing the caller ID information
to a number different from the original number.
So for you, it may look like your mother is calling,
but it could be someone else.
We're going to get into different ways
you can protect yourself when answering the phone
later on in this course.