# data[].attributes.headline
Threat to people through Social Engineering

# data[].attributes.subject
Threat to people through Social Engineering

# data[].attributes.body
Toyota Boshoku Corporation, an auto parts supplier, was the victim of a social engineering and BEC (Business Email Compromise) attack in 2019. The money lost amounts to USD 37 million. Using persuasion, attackers persuaded a finance executive to change recipient’s bank account information in a wire transfer.

# data[].attributes.attachment_link.title
Toyota Subsidiary Loses $37 Million Due to BEC Scam - CPO Magazine

# data[].attributes.attachment_link.description
Toyota subsidiary has recently lost $37 million in a BEC scam. Unlike many companies, the large fund transfer did not seem to raise any initial alarms and warnings.

# data[].attributes.body
One of the greatest dangers of social engineering is that the attacks don't have to work against everyone: A single successfully fooled victim can provide enough information to trigger an attack that can affect an entire organization.

Over time, social engineering attacks have grown increasingly sophisticated. Not only do fake websites or emails look realistic enough to fool victims into revealing data that can be used for identity theft, social engineering has also become one of the most common ways for attackers to breach an organization's initial defenses in order to cause further disruption and harm.

# data[].attributes.body
Shark Tank television judge Barbara Corcoran was tricked in a nearly USD 400,000 phishing and social engineering scam in 2020. A cybercriminal impersonated her assistant and sent an email to the bookkeeper requesting a renewal payment related to real estate investments. He used an email address similar to the legitimate one. The fraud was only discovered after the bookkeeper sent an email to the assistant’s correct address asking about the transaction

# data[].attributes.attachment_link.title
Shark Tank’s Barbara Corcoran Loses Nearly $400K to BEC Attack: What You Need to Know | Proofpoint US

# data[].attributes.attachment_link.description
ABC’s Shark Tank is known for providing entrepreneurs an opportunity to pitch their business ideas on TV to a panel of five investors (referred to as “sharks”), but unfortunately one of those high profile sharks was recently targeted by a cybercriminal intent on stealing some of her hard-earned cash…

# data[].attributes.body
Social engineering attacks are one of the main ways bad actors can scam companies. Here’s 15 of the biggest attacks, and how they happened.

# data[].attributes.attachment_link.title
15 Examples of Real Social Engineering Attacks - Updated 2023

# data[].attributes.attachment_link.description
Learn what social engineering is by exploring 15 examples of real social engineering attacks involving Google, Facebook, Twitter, and more.

# data[].attributes.headline
Ethical Hacker gets Sensitive Information on Live

# data[].attributes.subject
Ethical Hacker gets Sensitive Information on Live

# data[].attributes.body
Cybersecurity Expert Demonstrates How Hackers Easily Gain Access To Sensitive Information

# data[].attributes.attachment_link.title
Cybersecurity Expert Demonstrates How Hackers Easily Gain Access To Sensitive Information

# data[].attributes.attachment_caption
How hackers take over your accounts using social engineering 

# data[].attributes.headline
How can hackers infiltrate using Social Engineering

# data[].attributes.subject
How can hackers infiltrate using Social Engineering

# data[].attributes.attachment_link.title
How hackers take over your accounts using social engineering (Marketplace)

# data[].attributes.body
A spear phishing scenario might involve an attacker who, in impersonating an organization’s IT consultant, sends an email to one or more employees. It’s worded and signed exactly as the consultant normally does, thereby deceiving recipients into thinking it’s an authentic message. The message prompts recipients to change their password and provides them with a link that redirects them to a malicious page where the attacker now captures their credentials.

# data[].attributes.body
This is a more targeted version of the phishing scam whereby an attacker chooses specific individuals or enterprises. They then tailor their messages based on characteristics, job positions, and contacts belonging to their victims to make their attack less conspicuous. Spear phishing requires much more effort on behalf of the perpetrator and may take weeks and months to pull off. They’re much harder to detect and have better success rates if done skillfully.

# data[].attributes.body
An email sent to users of an online service that alerts them of a policy violation requiring immediate action on their part, such as a required password change. It includes a link to an illegitimate website—nearly identical in appearance to its legitimate version—prompting the unsuspecting user to enter their current credentials and new password. Upon form submittal the information is sent to the attacker.

# data[].attributes.body
As one of the most popular social engineering attack types, phishing scams are email and text message campaigns aimed at creating a sense of urgency, curiosity or fear in victims. It then prods them into revealing sensitive information, clicking on links to malicious websites, or opening attachments that contain malware.

# data[].attributes.attachment_link.title
What Is Phishing? Examples and Phishing Quiz

# data[].attributes.attachment_link.description
What is a phishing attack? Take our phishing quiz to learn about the different types and tactics. For example, spear phishing, whaling and pharming.

# data[].attributes.body
The attacker usually starts by establishing trust with their victim by impersonating co-workers, police, bank and tax officials, or other persons who have right-to-know authority. The pretexter asks questions that are ostensibly required to confirm the victim’s identity, through which they gather important personal data.

# data[].attributes.body
Here an attacker obtains information through a series of cleverly crafted lies. The scam is often initiated by a perpetrator pretending to need sensitive information from a victim so as to perform a critical task.

# data[].attributes.attachment_link.readable_text
Pretexting Definition

Pretexting is a certain type of social engineering technique that manipulates victims into divulging information. A pretext is a made-up scenario developed by threat actors for the purpose of stealing a victim's personal data.

During pretexting attacks, threat actors typically ask victims for certain information, stating that it is needed to confirm the victim's identity. In reality, the threat actor steals this information and then uses it to carry out secondary attacks or identity theft.

Sophisticated pretexting attacks may attempt to trick victims into performing an action that exploits the physical and/or digital weaknesses of an organization. For example, a threat actor might pretend to be an external IT services auditor and use this alias to convince the physical security team of an organization to allow the threat actor to enter the building.

Many threat actors who adopt this attack type masquerade as employees or HR personnel in the finance department. These disguises let them target C-level executives or other employees with extensive privileges, who are more valuable for attackers.

While phishing attacks tend to use urgency and fear to exploit victims, pretexting attacks establish a false sense of trust with a targeted victim. This requires threat actors to establish a credible story that does not make victims suspicious of any foul play.

Pretexting Attack Techniques

Pretexters use a variety of tactics and techniques to gain the trust of their targets and convince them to hand over valuable information.

Impersonation

An impersonator imitates the behavior of another actor, usually a trusted person such as a colleague or friend. This involves maintaining a sense of credibility, often by spoofing the phone numbers or email addresses of impersonated institutions or individuals.

An example of impersonation is the SIM swap scam, which exploits vulnerabilities in two-step verification processes including SMS or phone verification to take over target accounts. The pretexter impersonates a victim and claims to have lost their phone and persuades the mobile operator to switch the phone number to the attacker's SIM. One-time passwords are then forwarded to the attacker instead of the victim.

One successful social engineering attack involving impersonation was the 2015 attack on Ubiquiti Networks. Employees received messages from pretexers impersonating senior executives of the company and requesting payments to the attackers' bank accounts. This cost the company $46.7 million.

Tailgating

Tailgating is a social engineering technique that enables threat actors to gain physical access to facilities. To tailgate means to closely follow authorized personnel into a facility without being noticed. After reaching the entrance, the threat actor may quickly stick their foot or any other object into the door before it is completely shut and locked.

Piggybacking

Piggybacking is very similar to tailgating, except that the authorized individual is not only aware of the actor but also allows the actor to "piggyback" off the credentials. For example, authorized personnel arrives at the entrance of a facility. The individual approaches and asks for help, claiming to have forgotten their access badge. It could also be a woman holding heavy boxes. Either way, authorized personnel may decide to help these individuals to gain access to the building.

Baiting

A baiting attack is an attempt to make an attractive promise that will lure the victim into a trap. Typically, the attacker aims to spread malware or steal sensitive information.

Baiting attacks may use hardware like malware-infected flash drives as bait, often adding something that gives it an authentic look, such as a company label.

The bait is placed in commonly visited locations, such as lobbies, bus stations, or bathrooms. The attacker will place the bait in a way that victims will notice it and have an incentive to insert it into a personal or work device. The bait hardware will then deploy malicious software on the device.

Baiting schemes can also be carried out online. For example, enticing ads can lead victims to malicious websites or encourage victims to download a malware-infected application.

Phishing

Phishing involves impersonating a trusted entity in communications like emails or text messages, in order to obtain sensitive information like payment card details and passwords. Phishing is a separate category from pretexting, but these can be combined-phishing attempts often leverage a pretexting scenario.

Pretexting increases the chances of a phishing attempt being successful, for example, if target employees believe they are talking to a contractor or employer. Compromised employee accounts can also be used for further pretexting attacks that target individuals through spear phishing.

For example, the Canadian MacEwan University in Canada fell victim to a phishing scam in 2017, which cost the university around $9 million. The targeted staff changed payment details, believing the scammer was a contractor.

Vishing and Smishing

Voice phishing (or vishing) is a social engineering technique. This type of attack uses phone calls to trick victims into disclosing sensitive information or giving attackers remote access to the victim's computer device.

For example, a common vishing scheme involves the threat actor calling victims while pretending to be an official from the IRS. The attacker often threatens or attempts to scare the victim into giving compensation or personal information. IRS vishing schemes usually target older individuals. However, anyone can be tricked by a vishing scam when not adequately trained.

SMS phishing (or smishing) is a form of social engineering similar to vishing and phishing. It uses the same techniques but is perpetuated via SMS or text messaging.

Scareware

A scareware attack bombards victims with fictitious threats and false alarms. The victim is deceived into thinking that their system is infected with malware. They are then prompted to install malware or software that somehow benefits the threat actor. Scareware is also known as deception software, fraudware, and rogue scanner software.

For example, a common scareware attack involves displaying legitimate-looking popup banners in the browser of a victim surfing the web. The banner may display a text message such as, "Your computer may be infected with harmful spyware programs." The scareware then offers to install a certain tool (usually malware-infected) for the victim, or directs the victim to a malicious website where the computer becomes infected.

Scareware can also be distributed through spam emails that include bogus warnings or encourage victims to purchase worthless or harmful services.

Pretexting and the Law

Pretexting is, in general, illegal in the United States. For financial institutions governed by the Gramm-Leach-Bliley Act of 1999 (GLBA) (almost all financial institutions), it is illegal for any individual to attempt to obtain, actually obtain, or cause an employee to disclose customer information by deception or false pretenses. GLBA-regulated institutions must also enforce standards to educate their staff to identify pretexting attempts.

In 2006, Congress passed the Telephone Records and Privacy Protection Act of 2006, which extends protection to records kept by telecom companies. However, in other industries, it is not completely clear if pretexting is illegal. In future court cases, prosecutors will need to decide which laws to use to file charges under, many of which were not created with this scenario in mind.

How to Prevent Pretexting

Here are several methods businesses are using to protect themselves against pretexting.

DMARC

Pretexting includes impersonation, and to be successful the email must appear genuine. Thus, email spoofing is necessary. Domain-based Message Authentication, Reporting, and Conformance (DMARC) is the most prevalent form of protection for email spoofing, yet it is limited, as it requires continual and complex maintenance.

What's more, DMARC stops exact domain spoofing but does not display name spoofing or cousin domains spoofing, which are far more prevalent in spear-phishing attacks. Attackers have adopted these more sophisticated techniques mainly due to the effectiveness of DMARC.

AI-Based Email Analysis

To stop pretexting, businesses must strive for a more modern method of detection than DMARC. Next-generation anti-spear phishing technology uses artificial intelligence (AI) to study user behaviors and detect indications of pretexting. Furthermore, it can find anomalies in email addresses and in email traffic, such as display name spoofing and cousin domains. Natural Language Processing (NLP), a part of AI, examines language and can decipher phrases and words common in spear-phishing and pretexting.

User Education

Lastly, educate your users so they can identify pretexting by sharing real-life pretexting instances with them. Often, what makes spear-phishing and pretexting successful is that users are not familiar with the pretexting tactics mentioned above, and notice nothing abnormal about the requests they receive.

Educate users about the various sorts of email spoofing and train them to study email addresses for signs of display name spoofing and cousin domains. You must also have established rules about financial transactions, including validating requests in person or over the phone.

Pretexting Protection with Imperva

Imperva provides its industry-leading Web Application Firewall, which prevents pretexting attacks with world-class analysis of web traffic to your applications.

Beyond social engineering protection, Imperva provides comprehensive protection for applications, APIs, and microservices:

Runtime Application Self-Protection (RASP) - Real-time attack detection and prevention from your application runtime environment goes wherever your applications go. Stop external attacks and injections and reduce your vulnerability backlog.

API Security - Automated API protection ensures your API endpoints are protected as they are published, shielding your applications from exploitation.

Advanced Bot Protection - Prevent business logic attacks from all access points - websites, mobile apps, and APIs. Gain seamless visibility and control over bot traffic to stop online fraud through account takeover or competitive price scraping.

DDoS Protection - Block attack traffic at the edge to ensure business continuity with guaranteed uptime and no performance impact. Secure your on-premises or cloud-based assets - whether you're hosted in AWS, Microsoft Azure, or Google Public Cloud.

Attack Analytics - Ensures complete visibility with machine learning and domain expertise across the application security stack to reveal patterns in the noise and detect application attacks, enabling you to isolate and prevent attack campaigns.

Client-Side Protection - Gain visibility and control over third-party JavaScript code to reduce the risk of supply chain fraud, prevent data breaches, and client-side attacks.

# data[].attributes.attachment_link.title
What Is Pretexting | Attack Types & Examples | Imperva

# data[].attributes.attachment_link.description
Pretexting is a certain type of social engineering technique that manipulates victims into divulging information. A pretext is a made-up scenario developed by threat actors for the purpose of stealing a victim's personal data. During pretexting attacks, threat actors typically ask victims for certain information, stating that it is needed to confirm the victim's identity.

# data[].attributes.body
The looking popup banners appearing in your browser while surfing the web, displaying such text such as, “Your computer may be infected with harmful spyware programs.” It either offers to install the tool (often malware-infected) for you, or will direct you to a malicious site where your computer becomes infected.

# data[].attributes.body
Scareware involves victims being bombarded with false alarms and fictitious threats. Users are deceived to think their system is infected with malware, prompting them to install software that has no real benefit (other than for the perpetrator) or is malware itself. Scareware is also referred to as deception software, rogue scanner software and fraudware.

# data[].attributes.attachment_link.description
Scareware is a malware tactic that manipulates users into believing they need to download or buy malicious, sometimes useless, software. Most often initiated using a pop-up ad, scareware uses social engineering to take advantage of a user’s fear, coaxing them into installing fake anti-virus software…

# data[].attributes.body
attackers leave the bait—typically malware-infected flash drives—in conspicuous areas where potential victims are certain to see them (e.g., bathrooms, elevators, the parking lot of a targeted company). The bait has an authentic look to it, such as a label presenting it as the company’s payroll list.

# data[].attributes.body
As its name implies, baiting attacks use a false promise to pique a victim’s greed or curiosity. They lure users into a trap that steals their personal information or inflicts their systems with malware.

# data[].attributes.attachment_link.readable_text
Social engineering is rampant these days, and cyberactors are devising more ways to lure victims into their traps. One of the most common techniques used is baiting.

What is baiting in cybersecurity terms? Here are a couple of examples:
"Congratulations, you are a lucky winner of an iPhone 13. Click on this link to claim it." "Download this premium Adobe Photoshop software for $69. Offer expires in two hours."
If you use the internet regularly, you would've encountered these types of messages. The best thing is not to engage it because it's an excellent example of baiting, a form of social engineering attack that can compromise your organization's network security.

This article discusses baiting social engineering attacks, the techniques, examples, and prevention methods.

What is Baiting in Cybersecurity?

Unlike other types of social engineering, baiting promises an item, commodity, or reward to attract victims, infect their system with malware, and steal their sensitive information.

This social engineering technique is highly manipulative. It usually involves tempting offers like free music or movie downloads, expensive prizes, or discounts on premium software downloads.

Baiting attacks aren't limited to the digital world; they can also happen offline. One of the most common offline baiting attacks is via storage media like flash drives and laptops. Attackers can leave these devices in an open place for victims to use.

In a controlled experiment , the University of Michigan, the University of Illinois, and Google found that 45%-98% of people plug in USB drives they find.

Baiting Attack Techniques

Baiting feeds on human curiosity and greed, and cybercriminals can achieve this through different techniques. Below are the common baiting attack methods to be aware of.

Tempting Offers

Cybercriminals find major success using tempting offers to lure victims. They send targets enticing offers via ads, social media, email, or free downloadable content. They offer their victims access to free music, movies, games, and software. These offers are usually difficult to resist.

Malware-Infected Devices

Another way cybercriminals execute a baiting attack is through malware-infected USB devices or flash drives. They leave the device in the open such as the company lobby or reception office. Once an employee inserts the flash into their system, it automatically installs malware on the computer and infects the organization's network.

The attacker can also disguise themself as an employee, then plug the flash in on the targeted computer when no one is looking.

Why is Baiting Efficient?

Baiting is efficient because it exploits human nature-natural greed or curiosity. People get excited about free stuff, discounts, and special offers, which are often too good to be true. This is how well-set baiting works.

For an employee of a big company, being tricked by a baiting attack can cause massive problems for the entire organization. Every individual ought to learn how to recognize scammers' tricks and protect themselves from becoming prey in a baiting attack.

Baiting Examples

A great way to understand how baiting works is to get familiar with the examples. This increases your chances to prevent it. Cybercriminals can execute baiting attacks in different ways, online or offline.

You may get an email or receive a text from an unknown source claiming you've won a lottery, and you just need to provide them with your personal information-which is exactly what cybercriminals are after.

In some cases, an attacker can combine different tactics to execute their malicious plans. A typical example is when a cybercriminal tells their victims they missed a package delivery. In this case, attackers use digital dumpster diving to get information about your home and address.

The attacker then visits your home to hang a door tag saying: "You missed a delivery." The tag usually has a local phone number. The natural curiosity in you will dial the number to confirm the delivery.

Next, the person attending to you might send you a link to verify your information. While they can use the link to harvest your information, they can also upload malware on your computer.

How to Spot Baiting

Healthy skepticism and mindfulness can forestall baiting attacks. Here are some tips to prevent it:

Learn to think skeptically about any offer that's too good to be true

Use antivirus and anti-malware software on computers to detect malicious activity

Don't use external devices before you check them for malware

Set up proper network security measures to stop incidents before they happen

4 Tips to Avoid Baiting in Cybersecurity

Human curiosity and greed are inevitable - we all like enticing offers and gifts. However, we should be careful to avoid becoming a victim of baiting. Organizations should implement different measures to help counter such attacks. A successful attack can cause financial losses and reputational damages. Here are a few tips to avoid baiting in cybersecurity:

Stay Alert

Be prudent of communications that force you to act instantly. Attackers try to instill a sense of urgency to manipulate your emotions. So slow down and think before you react or perform any action. A good example is an offer that would expire in minutes.

Cybercriminals can share links in emails, tweets, posts, and messages to compromise systems or lure their victims into revealing sensitive information. If it looks suspicious, you probably shouldn't engage it.

Raise Cyberawareness of Your Employees

Ignorance increases the chances of falling prey to baiting or other social engineering attacks. It's impossible to prevent what you're not aware of. The best way to guard your company against baiting attacks is to educate yourself and your employees on baiting tactics and how to prevent them.

You can do this via seminars, training, and workshops to teach employees:

How to recognize a legitimate warning message, alert, or deceptive email and report it to the right investigative authorities

What to do when they click on malicious links

How to maintain good password hygiene, including setting a strong password and using a unique passcode for each account

Don't Follow Links Blindly

When you receive a message that includes a link, double-check it before engaging it. Do you know where it's coming from? If you don't know where the link will direct you to, don't click on it.

The best practice is to hover on the link with your mouse to see where it might send you. If you doubt its legitimacy, you can use our free URL check tool .

Organized Simulated Attacks

Organizations should conduct simulated baiting and phishing attacks to know their employee's level of awareness. You can try dropping flash drives in an open place where your employee can see them to know who'll fall for the trap.

In addition, organizations can simulate real-life phishing attacks to teach employees what to do in such circumstances.

Use Antivirus Software

In some cases, cybercriminals combine baiting with a phishing attack to compromise your system and gain access to sensitive information. Installing and updating your anti-malware and antivirus software is key to preventing malware from phishing emails.

From a business perspective, if a virus spreads further and exposes personal client data or sends unsolicited emails to your contacts, your company's reputation may be severely damaged. Prevention is better than cure, so have a system designed to prevent virus attacks.

Final Thoughts

Like other social engineering attacks, baiting is a serious issue that threatens individuals and organizations. A successful baiting attack can damage a company's reputation, cause financial losses, or even ruin the business.

Companies should conduct regular cybersecurity programs to teach staff how to detect and handle baiting and other social engineering attacks to mitigate such damage. Cybercriminals' tactics are constantly evolving. So organizations need to keep open communication between the security department and employees.

# data[].attributes.attachment_link.title
What is Baiting in Cybersecurity? Techniques, Examples, Protection

# data[].attributes.attachment_link.description
Social engineering is rampant these days, and cyberactors are devising more ways to lure victims into their traps. One of the most common techniques used is baiting. What is baiting in cybersecurity terms? Here are a couple of examples: "Congratulations, you are a lucky winner of an iPhone 13.

# data[].attributes.headline
Social engineering attack techniques to Leverage a Target

# data[].attributes.subject
Social engineering attack techniques to Leverage a Target

# data[].attributes.body
Make sure automatic updates are engaged, or make it a habit to download the latest signatures first thing each day. Periodically check to make sure that the updates have been applied, and scan your system for possible infections.

# data[].attributes.attachment_link.description
Antivirus software protects your personal information, data, bank account, and much more. We've tested more than 40 utilities to help you choose the top antivirus for your needs.

# data[].attributes.body
If an offer sounds too enticing, think twice before accepting it as fact. Googling the topic can help you quickly determine whether you’re dealing with a legitimate offer or a trap.

# data[].attributes.attachment_link.readable_text
Today is Safer Internet Day, an EU wide initiative aimed at keeping young people safe online. Parents are understandably concerned about the dangers their children face on the internet but can be complacent about their own vulnerability. Being an adult does not make you immune to the threat posed by online scammers, who use constantly-evolving tactics to steal from web users.

In 2016, the Competition and Consumer Protection Commission (CCPC) received more than 300 calls and emails to their consumer helpline relating to scams. Some of these were in person or by phone but consumers were also targeted by email, online or through social media sites.

"Consumers can protect themselves from scams in a number of ways," Áine Carroll, director of communications and market insights at the CCPC said. "The best way is to be vigilant - know what scams are currently out there and remember that there are always new variations of existing scams appearing."

Alarm bells should always ring if you are contacted out of the blue, you have won a prize but never entered a draw, you are asked for money up front or you are asked for your bank account, credit card details or other confidential, information. Don't divulge that information even if it appears to be from your bank or another reputable organisation, such as the Revenue.

Any kind of pressure on you to respond within a certain timeframe is also a major warning flag, scammers will try to get you to make a decision in a hurry. If a consumer has the time to think over a situation, they will see the flaws. Scams offering people under 55 access to pension schemes or investment opportunities for older consumers often fall into this category.

Another type of scam are third party sites offering services such as European Health Insurance cards, driving test bookings or travel visas. The language used suggests they are the official site but in reality they will charge you spurious and unnecessary 'administration fees'.

Always double check that you are on the official website of the organisation, a google search can often have scam sites return at the top so check the actual web address.

IT security company ESET Ireland last week warned about an example of the type of multi-layered fraud scammers use. It references Farmville, which was once the most-played game on Facebook. Analyst Urban Schrott explained: "It all starts with an email, claiming to come from PayPal and claiming a payment is being processed to FarmVille on Facebook."

The email suggests the user is due a refund but that the payment is on hold. It includes a link that appears to redirect to PayPal. But the link leads to a forged PayPal website with a Brazilian address. Users are asked to log in with their PayPal details and then told there is a problem and they need to enter all their bank details. The user is then told the refund is being processed but in reality the scammers now have all their information.

ESET Ireland advises anyone receiving this email, to flag it as spam and avoid clicking any links or attachments in such emails.

The specifics of that particular example highlight the importance of Ms Carroll's advice: "Always be wary of tempting offers and ask yourself why a company would be contacting you and asking you to verify your personal information."

If you fear you have been scammed, contact your local Garda station immediately. If you handed over your credit or debit card details, you should contact your bank or credit card company immediately.

The CCPC also ask that: "Consumers who have been affected by scams should let us know and we can help spread the word so others are not. This can be done by contacting us on Lo-call 1890 432 432. Building awareness about scams helps to prevent other people fall victim."

You can also check out the CCPC's register of current scams at www.consumerhelp.ie.

DEAL OF THE WEEK

The Expressway service is currently running its Big Red Seat Sale, with seats available from as little as €5.99 one way. The value fares are offered on 22 major routes nationwide.

€5.99 will get you from Dublin to Kilkenny or Clonmel and from Limerick to Abbeyfeale or Killarney.

If you want to travel from the capital to Galway, Wexford, Waterford, or Cork, you can get there for just €8.99.

The same price will also get you as far as either Derry or Belfast.

Expressway also offers a service to Dublin Airport from Ballyshannon or Monaghan for €8.99.

A trip from Cork to Dublin Airport costs just €12.99, or €10.99 from Kilkenny.

The promotional tickets must be purchased at www.expressway.ie and customers will receive a booking confirmation via email. This must be either printed off or displayed on a mobile phone when boarding. Tickets must be purchased for travel on or before February 26.

If there are any consumer issues that you'd like Gráinne to address or if you have problems that Gráinne could help with, she can be contacted at makingcents@examiner.ie

# data[].attributes.attachment_link.keywords[]
organisation: competition and consumer protection commission

# data[].attributes.attachment_link.title
MAKING CENTS: Know the scams and be wary of tempting online offers

# data[].attributes.attachment_link.description
Today is Safer Internet Day, an EU wide initiative aimed at keeping young people safe online. Parents are understandably concerned about the dangers their children face on the internet but can be complacent about their own vulnerability. Being an adult does not make you immune to the threat posed by online scammers, who use constantly-evolving tactics to steal from web users.

# data[].attributes.body
One of the most valuable pieces of information attackers seek are user credentials. Using multifactor authentication helps ensure your account’s protection in the event of system compromise. Imperva Login Protect is an easy-to-deploy 2FA solution that can increase account security for your applications.

# data[].attributes.attachment_link.readable_text
How does Multi-Factor Authentication work?

Multi-Factor Authentication (MFA) is a security system that verifies a user's identity by requiring multiple credentials. Rather than just asking for a username and password, MFA requires other-additional-credentials, such as a code from the user's smartphone, the answer to a security question, a fingerprint, or facial recognition.

MFA is an effective way to provide enhanced security. Traditional usernames and passwords can be stolen, and they've become increasingly more vulnerable to brute force attacks. MFA creates multiple layers of security to help increase the confidence that the user requesting access is actually who they claim to be. With MFA, a cybercriminal may steal one credential but will be thwarted by having to verify identity in a different manner.

Examples of Multi-Factor Authentication include using a combination of these elements to authenticate:

Codes generated by smartphone apps

Badges, USB devices, or other physical devices

Soft tokens, certificates

Fingerprints

Codes sent to an email address

Facial recognition

Retina or iris scanning

Behavioral analysis

Risk score

Answers to personal security questions

Types of authentication factors

When it comes to MFA, we typically refer to three types of authentication factors:

Things you know (knowledge), such as a password or PIN

Things you have (possession), such as a badge or smartphone

Things you are (inheritance), indicated through biometrics, like fingerprints or voice recognition

The latest MFA solutions incorporate additional factors by considering context and behavior when authenticating. For example:

Where you are when trying to obtain access, such as a cafe or home

When you are trying to access, like late at night or during the workday

What device you're using, such as a smartphone versus a laptop

What kind of network are you accessing, like private or public

Often called Adaptive Authentication, this type of MFA takes context into account to flag logins that are out of the ordinary. When a person tries to authenticate in an unusual context, Adaptive MFA may tighten security by requesting additional credentials. For example, if a user is logging in from a cafe late at night-and this is not typical for that user-the MFA tool may require the user to enter a code texted to the user's phone.

# data[].attributes.attachment_link.title
What is Multi-Factor Authentication (MFA), and how does it work?

# data[].attributes.attachment_link.description
Multi-Factor Authentication (MFA) is a security system that verifies a user's identity by requiring multiple credentials. Rather than just asking for a username and password, MFA requires other-additional-credentials, such as a code from the user's smartphone, the answer to a security question, a fingerprint, or facial recognition.

# data[].attributes.headline
Don’t open emails and attachments from suspicious sources

# data[].attributes.subject
Don’t open emails and attachments from suspicious sources

# data[].attributes.body
If you don’t know the sender in question, you don’t need to answer an email. Even if you do know them and are suspicious about their message, cross-check and confirm the news from other sources, such as via telephone or directly from a service provider’s site. Remember that email addresses are spoofed all of the time; even an email purportedly coming from a trusted source may have actually been initiated by an attacker.

# data[].attributes.attachment_link.readable_text
According to the US Cybersecurity and Infrastructure Security Agency (CISA), "most users get viruses from opening and running unknown email attachments." The agency goes on to say that opening a malicious email attachment allows hackers to alter your files, steal your credit card information, or worse. Here's everything you need to know about which email attachments are safe to open and how to scan an attachment on a Windows 10 computer.

Never Open Email Attachments Marked as Spam

By default, most email clients (like Gmail, Outlook, and Yahoo Mail) scan your email attachments for viruses. Most suspicious emails are either automatically deleted or filtered out from your inbox into a folder marked "Spam."

While it is safe to open any emails, you shouldn't click any links or open any attachments in emails marked as spam.

Unless you are using very old software, you won't get a virus just by opening an email anymore. This is because most viruses require you to take some sort of action (like opening an attachment or clicking on a link) in order to infect your computer these days.

Only Open Email Attachments from Trusted Sources

To protect yourself from malicious email attachments, the Federal Bureau of Investigation (FBI) warns you to "never open an email attachment from someone you don't know." The agency also advises you to "carefully examine the email address" before opening an attachment.

Hackers have the ability to "spoof" (or fake) an email address to make it look like it's from your boss, a family member, or even a major company like Apple or Microsoft. So, before you open an email attachment, you should always check the sender's full email address before opening an attachment.

For example, if you get an email from Amazon, the returns email address should end with @amazon.com. If the email address doesn't match the sender's name, or it looks suspicious at all, you should not open the attachment.

The Department of Homeland Security (DHS) says you can also identify malicious emails by looking for spelling and grammar mistakes, as well as messages that address you by the wrong name or emails that don't contain any content other than an attachment.

Hackers even have the ability to take over an email account and send malicious attachments with their email address. So, the FBI recommends you contact the sender to confirm they sent you an attachment before you click on it. If the email is from your bank or credit card company, you should go to their official website and find a way to contact them from there.

Only Open Email Attachments with Safe File Extensions

Once you know an email is from a trusted sender, hover your mouse over the attachment to see the file extension. This is the last three or four letters that appear after the period in a file name that lets your computer know which application can open the file.

Images, Video, and Audio Files:

Email attachments that contain images, videos, and audio files are generally considered to be the safest to open. These include files with common extensions such as JPG, PNG, GIF, MOV, MP4, MPEG, MP3, and WAV.

However, it is important to note that, even if an image looks safe, it could be another type of file in disguise. So, you should only open an attachment if you know who it is from, and you were already expecting the attachment.

Office Documents:

Microsoft Office documents can contain "macro" viruses, which are hard to detect because they are written in the same language as programs like Word, Excel, and PowerPoint. These include files with extensions like DOC, DOCX, XLS, and PPT.

The macro will not be activated automatically unless it is from a trusted location. So, in order to be able to edit the document, you will have to activate the macro manually by clicking the Enable Content button at the top of your screen. However, Microsoft warns you not to do so "unless you're certain that you know exactly what that active content does."

Executable Files:

One of the most dangerous types of files that hackers attach to emails is an executable file. If you open this type of file on your computer, it will almost certainly contain malicious software (also known as malware).

If you are on a Mac computer, you also want to watch out for DMG files, which can also be used to install malware on your computer.

Compressed Files:

Certain compressed files are also not safe to open. The most common of these have ZIP or RAR extensions. A compressed file usually contains multiple files that have been made smaller, and you won't be able to know what they contain until you open them.

If you open a compressed file, and it has an EXE file inside, you should only run it if you absolutely know what it is and who it came from.

Never Open Email Attachments with Double Extensions

Sometimes, email attachments will look safe at first glance, but if you look closer, you will notice the file name has two extensions. For example, a file name might look like an image, but it has a name like "file.jpg.exe". This means it's not a JPG file, but an EXE file because the last extension at the end of the file name is all that matters.

Any file with a double extension is most likely a virus, and you should never open it to be safe. If you want to make sure, you can scan it first. Here's how:

How to Scan an Email Attachment on Windows 10

To scan an email attachment on a Windows 10 computer, download the file, but don't open it. Then right-click the file and select Scan with Microsoft Defender. When the scan is complete, you will see the results at the top of the Settings window.

What to Do If You Opened a Dangerous Attachment

If you accidentally opened an attachment with a dangerous file extension, you should change your email password right away. You should also contact your bank or credit card company and let them know what happened, so they will be on the lookout for suspicious charges to your accounts.

Immediately after opening a dangerous attachment, you should run your computer's anti-virus software. Otherwise, you should download and install anti-virus software on your computer. To find out more, check out our list of the best anti-virus programs for Windows PC. If you think your computer is still infected with a virus, check out our guide on how to remove malware from a Windows 10 computer.

# data[].attributes.attachment_link.title
Which Email Attachments Are Generally Safe to Open? - The Plug - HelloTech

# data[].attributes.attachment_link.description
According to the US Cybersecurity and Infrastructure Security Agency (CISA), "most users get viruses from opening and running unknown email attachments." The agency goes on to say that opening a malicious email attachment allows hackers to alter your files, steal your credit card information, or worse.

# data[].attributes.body
Social engineers manipulate human feelings, such as curiosity or fear, to carry out schemes and draw victims into their traps. Therefore, be wary whenever you feel alarmed by an email, attracted to an offer displayed on a website, or when you come across stray digital media lying about. Being alert can help you protect yourself against most social engineering attacks taking place in the digital realm.

# data[].attributes.body
This is an Video description of what Social Engineering is and how can we protect ourselves (Please go the link for the video)