Spear-phishing attacks still happen and are still successful. According to Symantec: “The FBI estimates that the amount lost to BEC (Business Email Compromise) between October 2013 and August 2015 was over $1.2 billion. With such huge returns, it’s unlikely that these scams will cease any time soon.”
Symantec researchers also explained that “BEC attackers target senior-level employees rather than consumers as it’s easier to scam them out of large amounts. In one incident, we observed the scammers asking the target to transfer over US$370,000. By requesting large amounts of money, the scammers only need to be successful a couple of times to make a profit,”.
Usually spear-phishing emails are used for untargeted attacks. Lately we saw spear-phishing attacks becoming more targeted. An example is the CEO fraud attacks. A cyber criminal sends an email that appears to be from an executive (usually from the CEO to the CFO) asking for a specific payment to be processed immediately. The payment may be in any currently or even BitCoin(s).
There are a couple of tools online that you can use to check the email headers of incoming emails. The email headers allow you to check if a suspicious incoming email is actually a spoofed email as part of a spear-phishing attack campaign.
- Microsoft has a Message Header Analyzer that you can find in the following link: https://testconnectivity.microsoft.com
- Google as an email header analysis web application that you can find in the following link: https://toolbox.googleapps.com/apps/messageheader/
There is also a another website that will allow you to analyse the email header for free. However, you need to remember to delete the header from their records. This is done by a button when you scroll all the way down to the bottom of the results page.
- mxtoolbox has an email header analysis tool that you can find in the following link: http://mxtoolbox.com/Public/Tools/EmailHeaders.aspx