How to Spot Phishing Emails with Examples
Not every email is as benign as they look. The mail that appears to be from your boss requesting some important business information may actually be from cybercriminals trying to steal company data or compromise systems using phishing emails.
Phishing emails are fraudulent messages that attempt to trick you into providing important personal or business information or perform an action on behalf of an impersonator. These powerful emails are highly sophisticated and many appear as real as legitimate ones. Even as careful as attackers are, there are still some telltale signs for spotting phishing emails. We will look at some examples below.
1. Lack of Personal Salutation
In general phishing attempts, hackers scrape a large list of emails and send them generic non-personal messages. If you receive an email purportedly from a company with no personal salutation or information such as your name, treat such mail as suspicious.
Emails starting with “Dear sir/madam” or “Dear customer” are suspect and likely not from legitimate companies.
2. Mismatched URL
Many phishing emails include fake links to victims and asking them to click on them to perform actions such as filling a form, resetting passwords, or downloading malware.
Clicking such links may result in the stealing of login credentials and account takeover. Hackers usually employ similar URLs to the original to trick unsuspecting victims. A careful inspection would reveal that there are misspellings, hyphen separation, different TLDs, and inconsistent characters in the suspicious link.
When in doubt, visit the website directly by typing the correct address you know.
3. Request for Sensitive Information
Legitimate companies or management will not request sensitive information through email. They will not ask you to send your current password and login details for verification via email.
Other sensitive information requests such as credit card details, tax documents, and social security numbers from alleged government officials should be considered fraudulent and reported for further investigation.
4. Email with Only Hyperlinks
Hackers understand that some of their targets will hesitate to click suspicious links so they make every part of the email a clickable hyperlink.
Images, text, and videos in such mail are all hyperlinks and any accidental click would lead to the download of malicious files or opening a malware-hosting web page that can be used to compromise the user’s system.
5. Grammatical Errors in Mails
Some cybercriminals have a poor command of the English language and usually make grammatical mistakes in messages to targets. Some are from non-English speaking countries and rely on Google Translate to craft scam messages.
If you spot unprofessional or awkward use of English in an email, chances are that it is a phishing email.
6. Use of Non-Domain Emails
While hackers can take over a company’s email server to send phishing messages, it is rare. Most scammers rely on third-party mail providers.
Real companies send mails via their domain provider. Even companies with mail products such as Google and Microsoft use their official domain for sending emails. So, an email from Microsoft should be from the “username@microsoft.com” address and not “username@hotmail.com”.
Any email from a third-party mail provider or a different custom domain than the official website is likely a phishing attempt. Some spammers spoof the source of emails and it would require the analysis of email headers to detect such scams.
7. Unexpected Wins
A big lottery win you never participated in should trigger your suspicion. Even without checking other details, an email announcing such unexpected windfalls should be treated as a scam.
Such e-mails may also congratulate a company for winning a lucrative contract along with a request for bank details or credit card for contract “clearance”.
8. Missing or Poor Resolution Logo
An official business email usually includes the company logo. Due to laziness or lack of skills, some cybercriminals just copy whatever target company image they could get off Google while attempting to impersonate a business.
Often, such images are low-resolution and look unprofessional when embedded in emails.
9. Urgent Account Actions
Legitimate companies do warn users about suspicious activity on their accounts.
Hackers take advantage of this by sending fake emails to victims telling them their accounts have been suspended or hacked and asking for immediate login or password reset to resolve the issues.
An email asking you to log in quickly or risk losing your account or funds is likely from a phisher.
10. Request for Funds
For targeted scams such as CEO scams, cybercriminals conduct spear-phishing attacks to investigate their target organizations and employees so they can craft customized emails to bypass security systems.
The email is sent from a similar or spoofed email address of the CEO or business partners requesting fund transfers. Since it is hard to spot the problems in these kinds of emails, every request for funds should not be granted until further confirmation.
If you suspect a phishing email, try to reach the supposed author through another means and report such emails to the appropriate department.
Detecting phishing emails is essential to keeping your business data and networks safe from infection and unauthorized access. Regular anti-phishing training for your employees will help them stay alert and be on the lookout for phishing attempts. Advanced email protection systems should also be deployed to block malicious emails. At SDTEK we specialize in IT security and can help with all of your cyber security needs. Contact us today to learn more about our IT services.
The post How to Spot Phishing Emails with Examples appeared first on SDTEK | San Diego, CA.
