Given the recent spate of intrusions into various networks which have included compromise of subscriber identity and contact information, I figured it would be good for us to have a thread on how to spot and react to a "phishing" attempt.
While the most common and prominent avenue for phishing is by e-mail, these social engineering attempts can really take on any form. If Oscar has all of Alice's contact information (as may be the case in recent high-profile attacks) he may try to manipulate her via e-mail, phone call, SMS, or even by postal letter.
Oscar's attacks can be further augmented by intimate knowledge of Alice's more personal details. (Again, these may have been gained in some recent incidents.) Such details may include credit card numbers, purchase histories, birth date, dependents, "security questions and answers", etc.
Still, regardless of the attack vector and complexity, there are a number of features that often set phishing attempts apart from legitimate vendor correspondence. Additionally, there's a number of preventative and reactive measures which can be taken to protect oneself from falling victim to these attacks.
What are some "red flags" that are commonly found in phishing attempts?
What are some ways Alice can verify the identity of a suspected phisher, if she believes the contact may be legitimate?
If a suspect message includes a request for actions to be taken by Alice, and she believes the message may be legitimate, how should she follow up?
Again, answers are welcome for all attack vectors which may be used by someone with complete contact information for the target, possibly including:
- Phone number
- Voice call - "vishing"
- SMS messaging - "smishing"
- Physical address
- Postal mail
- Door-to-door solicitation
Note to moderators - This thread might be a good fit for Community Wiki.