Overview

Phishing is a type of social engineering attack designed to trick you into revealing sensitive information, visiting a malicious website, downloading harmful content, or performing an action that benefits an attacker.

Phishing attempts can appear through email, SMS, messaging applications, social media, websites, or other communication channels. They may imitate trusted companies, colleagues, administrators, financial institutions, or online services.

What Is Phishing?

Phishing attempts typically rely on deception rather than technical exploitation. An attacker may create a convincing message or website that appears legitimate and attempts to persuade you to take an unsafe action.

Common goals include stealing login credentials, obtaining financial information, accessing business accounts, distributing malware, or redirecting users to fraudulent websites.

Common Signs of a Phishing Attempt

Phishing messages often contain one or more warning signs. A single sign does not necessarily prove that a message is fraudulent, but multiple warning signs should be treated seriously.

• Unexpected requests for passwords or other sensitive information.
• Unusual urgency or pressure to act immediately.
• Suspicious or unfamiliar website addresses.
• Unexpected account verification requests.
• Unusual payment or billing requests.
• Unexpected attachments or downloads.
• Messages containing spelling, formatting, or grammatical inconsistencies.
• Requests that bypass normal company procedures.

Check the Website Address

Before entering your SPRL credentials or other sensitive information, carefully check the website address in your browser.

Attackers may create domains or URLs that look similar to legitimate websites. A familiar-looking logo, page design, or company name does not prove that a website is genuine.

Be Careful With Urgent Requests

Attackers often create a sense of urgency to prevent users from carefully evaluating a request.

Messages may claim that your account will be suspended, a payment is overdue, a security issue requires immediate action, or an important service will stop unless you act immediately.

• Do not allow urgency to override normal security checks.
• Verify unexpected requests independently.
• Contact the organization using a trusted communication channel.
• Do not use contact information supplied only in a suspicious message.

Protect Your SPRL Credentials

Your SPRL credentials should remain confidential. Legitimate support or business processes should not require you to disclose your password or authentication codes through an unsolicited request.

• Never share your SPRL password.
• Never share authentication codes.
• Never disclose private API credentials.
• Do not enter credentials into unfamiliar login pages.
• Do not send credentials through email or messaging applications.

Phishing & API Credentials

Attackers may specifically target developers and technical teams by pretending to be support personnel, service providers, or administrators and requesting API keys or other credentials.

API credentials can provide access to automated workflows and should therefore be treated as highly sensitive information.

• Never send API keys to an unsolicited contact.
• Do not place API credentials in public repositories.
• Do not include private credentials in screenshots.
• Store API credentials securely.
• Review credentials immediately if you believe they were exposed.

How to Verify a Suspicious Request

If you receive an unexpected request that appears to come from SPRL or another trusted organization, verify it independently before taking action.

1. Do not click links immediately.
2. Review the sender and message carefully.
3. Check the website address before signing in.
4. Open the organization's official website directly instead of using the supplied link.
5. Use a trusted contact method to verify unusual requests.
6. Do not provide confidential information until the request has been verified.

What to Do If You Clicked a Phishing Link

If you accidentally clicked a suspicious link, do not panic. The appropriate response depends on what happened after the link was opened.

• Close the suspicious website.
• Do not enter additional information.
• If you entered your password, change it immediately.
• Review your active login sessions.
• Review your account for unusual activity.
• If an API credential was exposed, secure or replace it immediately where applicable.
• Contact SPRL Support if you suspect unauthorized account access.

What to Do If You Submitted Your Password

If you entered your SPRL password into a suspicious website, assume that the password may have been exposed.

1. Change your SPRL password immediately.
2. Use a new password that has not been used elsewhere.
3. Review active login sessions.
4. Sign out of unfamiliar sessions where possible.
5. Review your account for suspicious activity.
6. Review your two-factor authentication settings.
7. Contact SPRL Support if you suspect unauthorized access.

What to Do If an API Key Was Exposed

If you accidentally provide an SPRL API credential to a suspicious website, person, or application, treat the credential as potentially compromised.

• Stop using the exposed credential.
• Replace or deactivate the affected credential where applicable.
• Review recent API activity.
• Check your connected application or integration.
• Investigate unexpected activity.
• Contact SPRL Support if assistance is required.

Phishing Protection for Organizations

Organizations should include phishing awareness in their security practices, particularly when multiple employees have access to SPRL or related business systems.

• Educate users about common phishing techniques.
• Encourage users to verify unusual requests.
• Discourage credential sharing.
• Use two-factor authentication where available.
• Establish procedures for reporting suspicious messages.
• Define what information employees should never disclose.

Phishing Warning Signs

Phishing Security Checklist

Frequently Asked Questions

What is phishing?

Phishing is an attempt to deceive users into revealing sensitive information, visiting malicious websites, downloading harmful content, or performing an action that benefits an attacker.

How can I tell if a message is phishing?

Look for unexpected requests, urgent language, suspicious URLs, requests for credentials, unusual payment instructions, unexpected attachments, and other behavior that does not match normal communication.

Does HTTPS mean a website is safe?

No. HTTPS protects communication between your browser and the website, but it does not prove that the website itself is legitimate. Always verify the domain and context.

Will SPRL ask for my password?

You should never disclose your password or authentication codes in response to an unsolicited request.

What should I do if I clicked a suspicious link?

Close the page and avoid entering further information. If you entered credentials, change them immediately and review your account security.

What if I provided an API key to a suspicious website?

Treat the credential as potentially compromised. Secure or replace the credential where applicable, review API activity, and contact SPRL Support if assistance is required.

Where should I report a suspicious SPRL link?

Use the SPRL Abuse Reporting process to submit suspicious or abusive SPRL links for review.

Quick Reference