Defence against phishing

Question

Level 1

8 points

Defence against phishing

Is there a way to safely check the url a link is pointing to on an iPhone/iPad. Similar to how you can hover your mouse over a link on a PC and see the url displayed?

I've tried pressing and holding my finger over a link on my iPhone, and it's opening up a preview of the site, and providing options to Open Link, Add to Reading List, Copy Link or Share. Is previewing the site safe, or is this just the same as having tapped the link?

On an Android phone, the press and hold technique works, but from what I've read it's unclear whether there's a safe way to check links on iPhone.

I want to educate my staff on the steps they can take to avoid falling for a phishing scam.

Thank you

Posted on Nov 29, 2020 5:51 PM

Reply

Answer 1

Top-ranking reply

ChrisJ4203

Level 10

230,666 points

Nov 30, 2020 4:00 PM in response to Shawry_18

Are you responsible for these devices, or are they individual phones when you are referring to "staff"? I would just advise them to turn off preview and not to click on any links. Are they getting that many in email from people they know? Just tell them not to click on any links from people they don't know. As hard as you try, unfortunately people are curious, and no matter what you tell them and how often you try and reinforce it, someone will eventually do it. Clicking on a link won't be bad, it is providing information in a link. Tell them that if they do click on a questionable link, don't provide any information and just delete the mail.

Reply

Answer 2

ChrisJ4203

Level 10

230,666 points

Nov 30, 2020 7:30 AM in response to Shawry_18

I just pressed and held a link in an email I have on my iPhone 12 Pro running iOS 14.2.1. It popped up information, but did not preview the page. There is an additional place to tap to get a preview, but you can see the link there, so I'm not sure why you cannot see what I'm experiencing. Here is a screenshot of what I get when I press on the link.

Reply

Answer 3

ChrisJ4203

Level 10

230,666 points

Nov 29, 2020 7:21 PM in response to Shawry_18

That is because there isn't a way to do it. The purpose of the support document is to help people recognize phishing attempts. People should not be tapping on links in an email from anyone they are not familiar with to start with. If they are suspicious of the link, they probably should not tap on it.

Reply

Answer 4

Shawry_18 Author

Level 1

8 points

Nov 29, 2020 8:28 PM in response to ChrisJ4203

It's my understanding that there was previously a way to view the full url of the link by simply pressing and holding the your finger on the link (the same way it works in Android), but that in a previous iOS upgrade this capability was changed.

I agree if you're not 100% sure you shouldn't tap on the link, but it can be a useful check if you can safely see the full url. As checking the domain name gives you a good indication of whether it's potentially malicious. I'm just hoping that when Apple altered the functionality they created a different way of checking the url behind a link.

Reply

Answer 5

Shawry_18 Author

Level 1

8 points

Nov 30, 2020 2:28 PM in response to ChrisJ4203

I see what you do, but by default it shows me the preview. If I tap hide preview my screen looks the same as yours. My concern is that I've no way of knowing exactly what my staff will get on their iPhones (will it display the preview or not). If it is a malicious link they click on and the preview loads is this equivalent to them having tapped the link, or does the preview provide some sort of protection. I'm not sure it does. I've checked Settings and cannot find any setting to turn off the preview.

Until I can get some certainty, I will have to stick with advising my staff NOT to open any emails that are remotely suspicious from their iPhones. It's better this be done from their laptops where they can check and verify any links to see where they go without clicking on them.

Reply

Answer 6

ChrisJ4203

Level 10

230,666 points

Nov 30, 2020 4:54 PM in response to Shawry_18

If that corporate email is Exchange mail, there are a number of things that you can restrict on people's devices, including making sure they have passcodes, setting auto-lock to immediate, etc. If like our work mail, the IT department has all of our outside mail setup to have a header at the top of all mail that says Caution: External Email. Do not click links or open attachments unless you recognize and trust the sender's email address. Seeing that on every email that you open can make you think.

Reply