It is bad enough when you receive marketing junk mail. When it appears to come from the Nevada Department of Employment, Training and Rehabilitation, it is a good deal more concerning. The DETR announced that it had been the victim of an email phishing scam targeting employees, sending out unsolicited emails asking for a reply. The reported goal was to collect personal data for use in fraud.

The emails came from an unofficial address dressed up to look official. Nobody should reply to one, or open it at all if that can be avoided.

The message opens by claiming to be from the Nevada Department of Employment, Training and Rehabilitation, and says that as a security measure following a recent upgrade there are issues with email. It then asks the recipient to reply to acknowledge it and wait for further instructions.

Reply, and the instructions that follow would be aimed at extracting data or personal information for fraudulent use.

So What Exactly is Phishing?

It can be described as a cyber attack using email addresses that look official, designed to gain someone’s trust so they reply with valuable data. These attacks are sometimes automated: a bot finds the email addresses within an organisation, then sends messages that appear to come from its server. Other times the email is simply disguised to look like it came from the real company.

Most email software can spot mail sent in bulk and will route it to junk, or delete it outright. But if it appears to arrive from a known server, it is far more likely to land in the inbox.

Official Email Marketing Campaigns

A legitimate campaign should only ever go out to people who opted in — in other words, the recipient agreed to hear from that company by ticking a box or completing a form. Most email marketing campaigns come from legitimate, pre-agreed addresses.

Mail from an employer is different. Employees are expected to open what lands in their work inbox, and that expectation is exactly what makes it a good target for cyber crime.

More from VisibilityBam