Today on our Tech for Business podcast, we're joined by our marvelous marketing masters.
I think is what we were called.
Tara, our marketing and business development manager at Kelsey, our graphic design and
brand strategist.
What long titles.
But there's so much that we do.
And today we're talking about is it malicious or is it marketing?
I'm actually going to go into Kelsey because I know that this idea kind of came up in a
different podcast.
And I was wondering if you'd give us a little background about how we ended up here today.
Yeah, totally.
I know this is weird to be on the other side of the mic to be like, not just listening.
I actually have to say something to you.
But we were talking post podcast as we do talking about your codes and people going, Hey, it's
spammy.
And then we were like, okay, when it really boils down to it.
And then we're going to do it for marketers and right for ad actors, people that design
fishing campaigns is what I'm going to call it for today.
We're both trying to get people to take an action.
So then it brings the question with all these tactics.
And Q R goes right, we'll go into all of that.
Is it malicious or is it just a creative marketing attempt to try to get you to buy a product
or connect with a company?
So yeah, that's long story short how we landed here today.
Sure.
So, Kara is our fearless leader.
I just want to level that a little bit because most of our listeners are in business of some
sort.
But could you explain a little bit the difference when we're talking about spam fishing and
marketing because sometimes it can feel similar?
Yes, it can.
And I think it's very pointed that we're talking about that today.
Most of our customers and prospects are used to CIT and how we go about engaging them.
And we do a lot via our emails that we send out to them and our website as well.
And we are big proponents of education to our customers as well.
So, we want to make sure today of how do you recognize some of those fishing pieces or spam
and ensuring that the email that you're getting from CIT is legit.
And we'll go into a little bit detail as to how you can find which ones would be malicious
and which ones are not.
But I know from the marketing perspective that CAND spam, excuse me, log went into place
in 2013.
And it's really basic information to protect us as CIT, but also the users that are going
to be getting those emails.
And it's really just as simple as is it looking like it's coming from CIT?
Are there weird and deceptive subject lines that are different from what generally CIT
would send out?
Is there an ad that somehow is in that email that might be a little too good to be true
that kind of makes you cause for a pause?
And I like to say it of, well, that's really weird.
I wonder if that's really actually happening at CIT.
And we really have to tell you to like where we're located.
So, if you get an email that doesn't have any of the contact information below or your
unsubscribe link below, those are kind of weird things that you want to kind of raise
your hand and be like, I think that's on.
Maybe I need to mark that as spam because it's not from CIT.
Yeah, we're all about that training.
We're all about that end user training here.
We talk about that more.
And I will have plenty of like educational materials and things in the description, even
some stuff you can kind of send out and train your employees on.
But I'm kind of wondering if it would be valuable to go a little bit into like, we talked a
little bit about like the different channels.
So email or Google ads or even an advertisement on TV, sort of what we kind of look for or
what's sort of expected.
Yeah, absolutely.
I'm excited to say, Terin, so much.
Do you want to go first?
Yeah.
Yeah, I'll go first and then I can hand it over to Kelsey.
So she had mentioned previously, like we in marketing are looking for what we call the
CTA, called the action.
So typically some type of email that we would send out or if it's a QR code on a postcard,
we're wanting you to take some type of action to then get some additional information because
we want to be very particular.
And when we're sending those that we know that you're a prospect or that you're a customer
and that you're interested in X, Y and Z.
So we do focus a lot on the segmentation of those messages.
So it would be odd if you're in, you know, finance and you're getting an email, you know,
about something that's not pertaining to you that typically will raise some of those red
flags.
And, you know, just kind of take a look at that, but that call to action is really kind
of that next step.
And there are ways that you can hover over and kind of take a look at it and see if it's
coming from the appropriate domain.
But I'll pass it to Kelsey and she can talk a little bit further on that.
Yeah.
And just to kind of zoom out a little bit, I think Terin's done a great job being like
here at CIT, we do all of these things and then kind of going, hey, as a consumer, what
do you expect?
What card, what sort of ads are you expecting to see?
It's the whole, hey, did you mention something?
Now you're getting five different Instagram ads about it.
And I'm like, this is both a good and a bad thing.
It's the hyper personalization, right?
I'm going, you're expecting to see these things because you took an action, which insider
knowledge, right?
That's going, hey, if you're using a private browser, you're not then right giving up your
IP address.
You're not showing what you're doing on their website.
So that's kind of the good and bad of going, hey, if you're expecting to be hyper personalized
marketing to that problem, it means that don't do the browsing.
If you'd rather that us as marketers not know anything about you, turn on that private
browsing 100% again, we're not technical resources.
We have separate podcasts about social engineering, all of that jazz, but go on from there and
then pulling back yet a step again of going, hey, we mentioned TV ads and QR codes.
That was the one thing that we talked with Todd, our, yes, COO and CISO.
Yeah.
But right.
So we asked him, we said, okay, super cool.
You see just a QR code on the screen, there's no branding.
There's no nothing.
It's just a QR code.
What do you do with that?
Again, if you pick up your phone, hover over it, it's going to pre-display a URL.
Now with a lot of different marketing software is that URL may not look, it may have some
Google gibberish before it.
It may have some Mercado gibberish before it.
So that alone, right?
Isn't telling you a ton about it, but it is going, you still haven't taken action.
And just by scanning a QR code, your phone is not automatically taking an action.
Yes, as their technology is going, hey, now you can do all of these different things.
You can open all these different things.
Yes, but typically in order to take that next step, you're clicking on it.
It's then opening the URL from there.
A lot of times then right there's the credential harvesting.
There's going through and saying, hey, enter all of this stuff.
Exactly as Tara talked about, if you scan it and all of a sudden it's going, get six
months of managed services free from CIT.
Yes, sadly, that's probably not an offer that we're running that maybe seems a little bit
sus by going back to, hey, it's a Super Bowl.
The amount of money and the amount of infrastructure that goes into those ads and the amount that
they're reviewed, it's highly unlikely that that's a malicious link.
Why?
Because right the advertising company, people test that before it goes live on the air,
where we see right ads on Google.
Those are being reviewed by Google, but the amount of ads that are going out daily that
people are submitting are just too many to be able to capture everything.
Even write the like suggested you are on the top of your Google search results.
Maybe phishing, hover over that.
They can make it look like just about anything, especially as we get into holiday season, depending
on whatever this episode airs.
Yeah, if you're shopping, maybe scroll down below, which then also is marketers, then
you're not paying for clicks on those top ones.
Little insider knowledge on all of those fun Google ads, but that's going from anything
from a QR code to a commercial to any of those things.
Just look at what's the source is that your local per is it a YouTube ad?
Those are Google ads.
That's probably easier to get on there.
Maybe pause.
Again, if you're a Google ad, you're probably good to go.
If it's a QR code, postcard from somebody at a booth that works for the company that
you're expecting, you can probably scan that code.
That's totally fine.
Stick around a light pole.
Yeah, I could probably just Google that company name or Google something about it.
I'm probably not going to just scan that in a coffee shop.
Again, slow down enough to question it for just a second is the very boiled down advice
there.
Yeah, I did want to mention one thing too, and we talk about this of just overall education
when it comes to cybersecurity is always you can go back out to their website.
If you feel like that email, don't click on the link.
Go out to CIT's website.
If you got an ad from Target, go to Target website and enter in.
If you need to sign into your account that way, that way you know it's a trusted source
and you see the little secure up there in that left hand corner where it's the web link.
Another little tidbit that I heard, I'm sure you guys are hearing constantly from CIT,
but it really does make sense to be like, well, just pause for a little bit and let's
try something different.
One last thing to note, it's going to be rare from marketers though too, like from CIT
that we're going to ask you to put in your password for something related to something
that we're offering, whether it's just a quick little webinar.
We don't have passwords where you have to enter in information.
That's something too, is kind of familiarize yourself with the process from the organizations
that you're working with.
If it's something out of that norm, that's going to raise a little bit of the red flags
to be like, we are, they've never asked of me before, should I do that?
Just wanted to mention that piece.
100% and kind of right to go, hey, this is everything that we're doing.
This is what to expect.
It's also going, hey, maybe if you're listening and you have an internal marketing department
and they're sitting and I know, Terry.
We sit at our leadership meetings, right?
And we occasionally get feedback internally of now looks spammy.
That looks like fishing, which right is a marketer here?
Like, no, it's nothing that I ever wanted.
And right as our in-house kind of graphic designer is one of my roles, we try to pride
ourselves in doing graphic design that looks professional.
It doesn't look like we used word art to make it, which right is kind of a fine sort of,
right?
And I'm not saying that occasionally also realizing that your mail, right?
So I'll look at my desktop.
Could review all of the good, beautiful, gorgeous images that we threw in an email all formatting
and all of a sudden you got Gaby Gooke and you're like, yeah, that does look like fishing.
Do I also love our security team and realize that there's a lot of things in place internally
to make sure that we're secure?
Yes, 100%.
Does that email occasionally look a lot better on my phone?
Yes.
100%.
So right, realizing where some of the plain text emails that you may see coming from,
right, that's part of we have to look at it as marketers and go, what makes sense to add
a visual versus what makes sense to have a plain text because the content is more important
than the res of dazzling, even though I love to make things sparkly and love to make them
look good.
But it's just the world that we live in that those images may be removed.
And then you're going, hey, I even got an email the other day that said, if you can't
see this email, click allow images.
And it was like, yes, 100%, you may get some of that just by allowing images again is not
all of a sudden putting yourself in a giant security risk, which again, I feel like I
should ask for a marketer, not a cybersecurity expert.
Could that ever be a thing potentially?
But all it's doing is allowing those images to download, which we've all had emails that
are completely blank until that downloads.
And then you're going, it's because the marketer wanted to use a gift, whichever one you're
saying today.
And they wanted it to look pretty, yes, most of the time.
For sure.
I think I also wanted to add that a lot of our listeners are like, IT admin or security
professionals.
And you might be listening to this and getting like, like it's the holiday season, like what
they're doing on their personal phone is, you know, I hope that they're safe, but it's
not my job.
And you know what, there's a blend of like your work technology and your home technology.
I know that I have teams on my personal phone.
Like there is this blurring line, not that it's the security's responsibility to take
care of what you're doing in your personal life, but you still need to keep these things
in mind when you are doing your holiday shopping, doing these things for Black Friday, because
there might be something on your phone that's going to connect back to your business and
your company.
That just sparks something.
Sorry, Darryl, I'm like, text marketing, text marketing, right?
Because that's another tool in the toolkit of is it malicious?
Is it marketing?
Do I get now an entire, essentially, I'm that person, if anybody listening looked at my
phone, they'd be like, you have that many unredeux messages.
And I'm like, well, I have an Apple watch.
So I see right in the advertisements come up and then I just spray it to mark them as
red has Apple address that.
Yes, I could tangent on that, but we're going to move right on past that.
But go on the text that you get, hey, we couldn't deliver this package.
Please click here.
Right.
And those, again, sense of urgency, very timely, those things.
Typically with UPS, ever send you a text message, without you opting in.
No, you would know you would have opted in.
It would have been from an expected number.
It would not have just randomly been, hey, I put my number in for an order.
Yes, but you still have to opt into texting.
Again, it's that taking the action of going, I said yes to this.
So I'm expecting it.
And the tears point earlier, you can go out and check your order number just to be safe.
But that's to your point, Ariel guy, hey, we have work things on our devices are devices
also managed by work without the other.
Yeah, that's a whole number of tangent that you can get into.
But that's something that, hey, you're running around on your lunch break.
You click on something, because it was text message.
Yeah, 100%.
That's another way that could be just a good educational thing for your entire staff.
Yeah, I was just going to mention along those lines, Ariel, and with the IT folks that might
be listened to, they will adhere to certain policies.
So if you are your acceptable user policy to make sure that you're not doing a bunch
of personal stuff on your work device, because a lot of organizations will have that just
from a cybersecurity perspective.
But I think we've all been, we've all done it, you know, on occasion, like Kelsey said,
you got a text and you have some of it on your personal phone.
But especially with the holidays, I know I was listening to the news that a lot of people
are starting the Black Friday sales now.
And so just keep that in mind that you're going to start to see that because even though
some people may wait into the true holidays, there's a lot of stuff that's ticking up right
now that there's deals going on.
And again, you know, getting back to if it sounds too good to be true, then maybe second
guess it and be like, I don't think that's really going to happen.
Or, you know, there's some type of ad that is like misspelled and looks a little weird
too.
Those are kind of telltale science to kind of shy away from that and be like, no, thank
you on put them in the spam folder, Marcus, spam, phishing and move on.
Marcus spam, yeah, do a little fall cleaning on your inbox.
Do a couple unsubscribes, 100%, which I think all on this too made me think of when Tara
and I were looking at different resources before this that go like, there's malnortizing.
So again, is it malicious or is it market marketing?
Is it malnortizing?
If it's an ad that doesn't seem to align with you recently looked at pots and pans that
may see is because they are on a Black Friday sale.
All of a sudden it's an ad for something that's completely outside the realm of anything you've
been shopping for.
That should be suspicious.
It's not just bad marketing.
It could be bad marketing of going, hey, we picked the wrong target market and did these
things.
And hey, if a marketing team is doing Google ads, there's a good chance that they're trying
to make it hyper personalized to you to not just say, as a marketer, I would never go,
hey, your package is late.
By the way, here's how we can secure you for cyber security.
That's a little bit too mean.
That's taking it to a place that I would not want to go.
That's click baiting to a place that's going.
Yeah, I would agree with the feedback that looks spammy.
Yeah.
I think, again, I'll have a ton of resources in the description, but it really comes down
to rust between the customer and the company.
We trust you to opt in, and if you don't want that information, we give you the opportunity
to opt out.
And so if anything is outside of that relationship, then I would question it.
But I wanted to open it up.
If there's anything else you wanted to share.
Again, it's a part of the end.
I was saying anything from you, Tara?
We like to tangent so we can always go down different routes.
But I think that really gets to the gist of it.
We wanted to make sure that everybody was just aware of what's out there, especially
like I had mentioned, the holiday seasons coming up, just cause for pause, as I like
to say, of what's really going to be real.
And if you ever have questions, that's why you have your IT department is to ask them
to because maybe if there's something weird, market is fishing because they can always retrieve
it back if it actually was a legitimate email.
So again, better be safe and sorry, because you don't want to be that person we talk about.
It's really the end user that typically is causing the most issues when it comes to cybersecurity.
So make sure you're not going to be that one user that happens to click something that
could could lead to a lot of damage to your organization.
And on the flip side, and any of the organizations that are big enough to have internal marketing
or if you work with somebody external and you're going, should we be concerned?
I'm seeing all these reports that QR codes are being used for fishing.
Should we not use QR codes?
Should we not use these additional technologies?
Should we not use Google ads?
It is your business's decisions.
I'm not here at all to go, no, you should do this.
Of course, I'm going to lobby for the side of going, hey, trust your marketers to do
things that are ethical.
Don't look too like 80.
Don't have misspellings, aren't sending out things without an unsubscribed link, right?
Just good best practices, but still allowing that bit of creative freedom to go.
Hey, it is a super nice way to link somebody to the information they need with a QR code.
That's accessible that people are getting used to.
So right, that would be my little personal that I'm like, please don't shy away from
this great technology that we have or from using texts as part of your advertising scheme
from using Google ads from doing these things, but also realizing that with your brand, you're
still being consistent, you're still using the same voice, you're still doing things
that your customer base expects and you're hyper personalizing everything to them with
realizing that they have the ability to opt out of giving you any information that you
still have to have a fallback of going, what do I do if I know nothing about you?
I did want to mention, sorry, one last thing, Ariel, and then I will, I promise I'll be
quiet.
So with CIT, we're somewhat small enough that we're able to let all of our CIT employees
know when we're sending out large customer communications.
And I wanted to mention that because I do think that is key.
I mean, we use our internet and also our team's messaging.
So our support staff does know if we send out a large message to customers.
So if any questions do come up, they're able to look into that information to say, yes,
that I actually was marketing.
There are actions that need to happen.
So kind of another fail safe thing just to make sure everybody is included on those communications.
I know with larger ones, it might be difficult to let everybody know everything that marketing
is doing.
But some of the ones that are very important when it goes to a larger group of customers,
I think it's really nice to keep that interdepartment communication very active and knowing what's
happening.
Tara, that was a great point that I saw that I saw almost done.
You're like, I was like, see you, I'm going, what Tara is talking about is what we define
as operational email.
So to go back and if you're like, hey, I got an email from CIT and there was no unsubscribing,
may have been an operational email.
Operational emails are things like you signed up for a webinar and confirmation here is
something that we think those typically do not have an unsubscribe link at the bottom
because there is no sales method going.
You could have unsubscribed from something, but we want you to get the email link to a
webinar if you got that.
If you're a user of one of the services and we have an important communication to you,
that's considered an operational send versus a marketing send, which yes, 100% document
what you're doing, communicate to internal and then externally know what to expect.
I realized that just because something doesn't have unscribed, look at what the content is.
If it's you're a managed services customer and this is an update of something that you
have installed, yes, of course, we'll also provide the phone number and the email.
You don't even have to respond to that email.
You can call to verify, but those types of things.
Now if it's like red alert, all this stuff is on fire and it seems to be out of CIT's
process, yeah, calls for pause.
For sure.
I was just going to re-highlight the communication, not only in between the business and the customer,
internally like Kara said, and then we work closely with our security department.
If they have questions like the QR code question, they will just ask us.
If you are an IT professional and you're concerned about something, just ask.
Just talk to your marketing department, see if they consider it, or do some research and
help each other out.
I think on that note, thank you, Kara and Kelsey, for joining us today.
This was such a fun, different podcast.
If you enjoyed this, please like and subscribe.
It's how we know that you are interested in these topics.
If you have a question or a topic, reach out to us at info at cat-net.com, or head out
to our website, cat-net.com slash podcast.
And we'll be back next week with an all-new episode.