One of the most important elements of fishing is choosing the right lure or bait. The same is true when it comes to the malicious digital version—phishing. A phishing attack requires good bait to be effective. Organizations can defend against phishing attacks and help protect customers by using EV certificates to verify the authenticity of the website.
Phishing Attack Targets
Phishing attacks are designed to fool a victim into believing the phisher is a specific, trusted party for the purpose of stealing credentials, accessing sensitive data or propagating malware. The foundation of phishing depends on the ability to create a false identity that the target audience will believe is the real thing.
The most common targets for phishing attacks are online businesses—specifically, online businesses where customers generally conduct financial transactions or share sensitive data. Businesses of all sizes from small “mom and pop” shops to large enterprises are viable targets for phishing. Businesses in pretty much every industry are potential targets for phishing attacks, but the most high-profile phishing attacks typically focus on banks, credit unions, investment websites, ecommerce retailers and other similar businesses.
Creating a Credible Counterfeit
Due to the way the web is designed and the nature of HTML code, it is trivially easy to counterfeit a website. A simple “screen scrape” is all that’s required most of the time. You can right-click and save most images, or just link to the original images and code from the site being spoofed.
Voilà! The content inside the browser’s display window for a counterfeit phishing site can—and usually does—look identical to the content on the actual site. It actually helps maintain the façade of authenticity to leave legitimate links on the counterfeit site as well and only changing or redirecting a couple key elements.
Avoiding Phishing with EV Certificates
That’s where an EV certificate comes in handy. The attacker can scrape, download, stream or link to most—if not all—of the elements that are within the confines of the HTML window. However, there is no way for the attacker to re-create or spoof the green address bar of a website with an EV certificate. Because the EV certificate indicator is outside of the HTML window in the browser interface itself, it can’t be spoofed or counterfeited.
Websites that have an EV certificate give users a clear and simple way to determine if the website is legitimate or a counterfeit. It’s a good idea for organizations to give customers the tools they need to recognize and avoid a phishing attack. In the absence of an EV certificate, people don’t have that same opportunity.
Maximize the Value of the EV Certificate
Aside from helping customers steer clear of spoofed sites and phishing attacks, a recent survey highlights the fact that people have more confidence and trust in websites that are validated with an EV certificate. To get the most value out of the investment in an EV certificate, though—and ensure that users benefit from it as well—you need to follow a few simple tips:
- Use green address bars consistently on all customer-facing pages on the site.
- For companies operating with multiple brand names, use the brand names on certificates that match the brands of those sites.
- Proactively communicate to customers that your site has green address bars and what to look for (including images of what to expect in popular browsers)
- Include this message on appropriate portions of the website.
- Include this message in outbound communications such as newsletters and security bulletins.
By communicating with customers what to expect when they visit your websites and what to look for to verify that the website is legitimate, and then universally using EV certificates that are consistent with the brand of the website for all public-facing sites, you can help customers recognize and avoid spoofed versions of your website(s).
Phil Ballew is the Zesty.io community manager, working with developers and building the Zesty.io community through many unique outlets. Connect with him on 