With phishing email attacks more prevalent than ever before, it’s imperative that you brush up on your detection skills. In February 2021, the FTC reported that more than $3.3 billion was lost by consumers due to fraud in 2020. This number is “up from $1.8 billion in 2019, and almost “$1.2 billion of losses reported last year were due to imposter scams” including phishing emails.
By learning how to spot a phishing email, you may be able to prevent yourself from becoming another victim.
Accurately measure risk & automate compliance with Rivial Security.
If you read the “From” section of the email, you will be able to see whether or not the email came from a legitimate source. Both the “From” and “Reply-to” sections should match. Then again, if the sender is using an email service provider such as MailChimp or Constant Contact, these fields will not match. Instead, the “from” may read something like “admin@mailchimp.com” and the “Reply-to” will read the sender's actual email address. The important thing to investigate here is whether or not the “third-party” is legitimate.
You should also look for things like misspelled domains in the sender’s email address, or a 0 where you expect the letter “o” to be. For example, wind0ws.com or Faceb00k.com. Real companies and authorized representatives wouldn’t make mistakes like these.
The best method for how to spot a phishing email is to view it on your desktop. By doing so, you can simply hover over a hyperlink’s anchor text with your mouse and see where you’re being directed to. Alternatively, if you are viewing the email on your phone, do not click the link. Instead, copy the link and paste it into a text message or note to find out where the link is directing you. If it’s not where you’re expecting to go, the sender could be phishing for information and clicks.
In some cases, phishing cybercriminals will hyperlink the entire body of the email, or send an image that is hyperlinked in the hopes that you will click somewhere within it either intentionally or by accident. That click could cause a malware program to instantly be downloaded to your computer to record information up to and including:
While it’s true that some people send email messages from their smartphones and misspell words as a result, phishing emails are typically laden with poor spelling and grammar. Microsoft states that one of the reasons these errors can occur is that they are “sometimes the result of awkward translation from a foreign language, and sometimes they're deliberate in an attempt to evade filters that try to block these attacks.”
Accurately measure risk & automate compliance with Rivial Security.
If you receive an email asking for login information, account details, or other private data, there is a large chance you have received a phishing email. Companies that are legitimate will never ask you for details like this via email.
Feeling like your data may be at risk? Get in touch with us for data security services.
Not to burst your bubble, but it’s highly unlikely that you will ever receive a legitimate email detailing a large windfall or “charity donation” to you or in your name. For starters, if you have been left an inheritance, you will likely receive legitimate correspondence via phone or the postal service.
Secondly, if you did win a raffle or some other kind of prize, it’s unlikely you will be informed via email. While “winning” something can feel exciting, your guard should always be up when it comes to emails. This is especially true if you have not even entered any kind of raffle or prize giveaway!
And, if you’re asked for banking information via email to receive the money, that’s another red flag!
Three of the most common phishing emails we have seen make the following threats:
Now that you know how to spot a phishing email, what should you do if you receive one? First, don’t click anything, and don’t respond to the sender. Some companies have set up reporting services to submit phishing emails to if you choose to. You may want to do that in an effort to help these businesses prevent future attacks. On the other hand, in most cases, your best course of action with phishing emails is to simply flag the email as spam and delete it.
Hopefully, this post has made you more aware of the phishing scams that are out there. Be careful with what you click, and how you engage with the messages that land in your inbox.
Rivial Security offers social engineering testing to see how your employees engage with potentially malicious content.
Accurately measure risk & automate compliance with Rivial Security.