Phishingย is one of the most common methods of cyber crime and scams, but despite how much we think we know about these scam emails, people still frequently fall victim.
Action Fraud receives more than 400,000 reports of phishing emails each year, and according to Verizonโs 2020 Data Breach Investigations Report, more than two thirds of data breaches involved social engineering attacks such as phishing.
In this article, we use real phishing email examples to demonstrate five clues to help you spot scams.
Source: IT Governance
1. The message is sent from a free email address
No reputable organisation will send emails from one of the many free email domains, e.g emails ending with @gmail.com or @hotmail.com, outlook.com and many others.
Not even Google will do this, their emails come from google.com.
Most organisations, except very small businesses who don’t know better, will have their own email domain and company accounts, so their email will come from [email protected]
If the domain name (the bit after the @ symbol) matches the apparent sender of the email, the message is probably legitimate, although be warned, this can also be spoofed.
The best way to check an organisationโs domain name is to type the companyโs name into a search engine.
This makes detecting phishing seem easy, but cyber criminals have plenty of tricks up their sleeves to deceive you.
Top tip: Look at the email address, not just the sender
Many of us donโt ever look at the email address that a message has come from.
Your inbox displays a name, like ‘Paypal Supportโ, and the subject line. When you open the email, you already know (or think you know) who the message is from and jump straight into the content.
When crooks create their bogus email addresses, they often have the choice to select the display name, which doesnโt have to relate to the email address at all.
They can, therefore, use a bogus email address that will turn up in your inbox with any display name they choose.
But criminals rarely depend on their victimโs ignorance alone. Their bogus email addresses will use the spoofed organisationโs name in the local part of the address.
Take this example of a phishing email mimicking PayPal:
This is a nearly flawless scam email. It uses PayPalโs logo at the top of the message, it is styled professionally and the request is believable.
But as much as it attempts to replicate a genuine email from PayPal, thereโs one huge red flag: the senderโs address is โ[email protected]โ.
A genuine email from PayPal would have the organisationโs name in the domain name, indicating that it had come from [email protected]. That PayPal isnโt in the domain name is proof that this is a scam.
Unfortunately, simply including PayPal anywhere in the message is often enough to trick people.
They might glance at the word PayPal in the email address and be satisfied, or simply not understand the difference between the domain name and the local part of an email address.
2. The domain name is misspelt
Thereโs another clue hidden in domain names that provide a strong indication of phishing scams ยญโ and it unfortunately complicates our previous clue.
The problem is that anyone can buy a domain name from any registrar. And although every domain name must be unique, there are plenty of ways to create addresses that are indistinguishable from the one thatโs being spoofed.
The Gimlet Media podcast โReply Allโ demonstrated how difficult it can be to spot a spoofed domain in the episode What Kind Of Idiot Gets Phished?. Phia Bennin, the showโs producer, hired an ethical hacker to phish various employees.
The hacker bought the domain โgimletrnedia.comโ (thatโs r-n-e-d-i-a, rather than m-e-d-i-a) and impersonated Bennin.
His scam was so successful that he tricked the showโs hosts, Gimlet Mediaโs CEO and its president.
You donโt need to fall victim to help criminal hackers
As Bennin went on to explain, you donโt even need to fall victim for a criminal hacker to gain vital information.
In this scam, the ethical hacker, Daniel Boteanu, could see when the link was clicked, and in one example that it had been opened multiple times on different devices.
He reasoned that the targetโs curiosity kept bringing him back to the link but that he was suspicious enough not to follow its instructions.
Boteanu explains:
Iโm guessing [the target] saw that something was going on and he started digging a bit deeper and [โฆ] trying to find out what happened [โฆ]
And Iโm suspecting that after, [the target] maybe sent an email internally saying, โHey guys! This is what I got. Just be careful. Donโt click on this [โฆ] email.
Boteanuโs theory is exactly what had happened. But why does that help the hacker? Bennin elaborates:
The reason Daniel had thought [the target] had done that is because he had sent the same email to a bunch of members of the team, and after [the target] looked at it for the fourth time, nobody else clicked on it.
And thatโs okay for Daniel because he can try, like, all different methods of phishing the team, and he can try it a bunch of different times. [And] since [the target is] sounding alarm bells, he probably wonโt include [him] in the next phishing attempt.
Therefore, in many ways, criminal hackers often still win even when youโve thwarted their initial attempt.
That is to say, indecisiveness in spotting a phishing scam provides clues to the scammer about where the strengths and weaknesses in your organisation are.
It takes very little effort for them to launch subsequent scams that make use of this information, and they can keep doing this until they find someone who falls victim.
Remember, criminal hackers only require one mistake from one employee for their operation to be a success. As such, everyone in your organisations must be confident in their ability to spot a scam upon first seeing it.
3. The email is poorly written
You can often tell if an email is a scam if it contains poor spelling and grammar.
Many people will tell you that such errors are part of a โfiltering systemโ in which cyber criminals target only the most gullible people.
The theory is that, if someone ignores clues about the way the message is written, theyโre less likely to pick up clues during the scammerโs endgame.
However, this only applies to outlandish schemes like the oft-mocked Nigerian prince scam, which you have to be incredibly naive to fall victim to.
That, and scams like it, are manually operated: once someone takes to the bait, the scammer has to reply. As such, it benefits the crooks to make sure the pool of respondents contains only those who might believe the rest of the con.
But this doesnโt apply to phishing.
Automated attacks
With phishing, scammers donโt need to monitor inboxes and send tailored responses. They simply dump thousands of crafted messages on unsuspecting people.
As such, thereโs no need to filter out potential respondents. Doing so reduces the pool of potential victims and helps those who didnโt fall victim to alert others to the scam, like we saw in the earlier example with Gimlet Media.
So why are so many phishing emails poorly written? The most obvious answer is that the scammers arenโt very good at writing.
Remember, many of them are from non-English-speaking countries and from backgrounds where they will have limited access or opportunity to learn the language.
With this in mind, it becomes a lot easier to spot the difference between a typo made by a legitimate sender and a scam.
Top tip: Look for grammatical mistakes, not spelling mistakes
When crafting phishing messages, scammers will often use a spellchecker or translation machine, which will give them all the right words but not necessarily in the proper context.
Take this example of a scam imitating Windows:
No individual word is spelled incorrectly, but the message is full of grammatical errors that a native speaker wouldnโt make, such as โWe detected something unusual to use an applicationโ.
Likewise, there are strings of missed words, such as in โa malicious user might trying to accessโ and โPlease contact Security Communication Centerโ.
These are consistent with the kinds of mistakes people make when learning English. Any supposedly official message thatโs written this way is almost certainly a scam.
Thatโs not to say any email with a mistake in it is a scam, however. Everyone makes typos from time to time, especially when theyโre in a hurry.
Itโs therefore the recipientโs responsibility to look at the context of the error and determine whether itโs a clue to something more sinister. You can do this by asking:
- Is it a common sign of a typo (like hitting an adjacent key)?
- Is it a mistake a native speaker shouldnโt make (grammatical incoherence, words used in the wrong context)?
- Is this email a template, which should have been crafted and copy-edited?
- Is it consistent with previous messages Iโve received from this person?
If youโre in any doubt, look for other clues that weโve listed here or contact the sender using another line of communication, whether thatโs in person, by phone, via their website, an alternative email address or through an instant message client.
4. It includes suspicious attachments or links
Phishing emails come in many forms. Weโve focused on emails in this article, but you might also get scam text messages, phone calls or social media posts.
But no matter how phishing emails are delivered, they all contain a payload. This will either be an infected attachment that youโre asked to download or a link to a bogus website.
The purpose of these payloads is to capture sensitive information, such as login credentials, credit card details, phone numbers and account numbers.
What is an infected attachment?
An infected attachment is a seemingly benign document that contains malware. In a typical example, like the one below, the phisher claims to be sending an invoice:
It doesnโt matter whether the recipient expects to receive an invoice from this person or not, because in most cases they wonโt be sure what the message pertains to until they open the attachment.
When they open the attachment, theyโll see that the invoice isnโt intended for them, but it will be too late. The document unleashes malware on the victimโs computer, which couldย perform any number of nefarious activities.
We advise that you never open an attachment unless you are fully confident that the message is from a legitimate party. Even then, you should look out for anything suspicious in the attachment.
For example, if you receive a pop-up warning about the fileโs legitimacy or the application asks you to adjust your settings, then donโt proceed.
Contact the sender through an alternative means of communication and ask them to verify that itโs legitimate.
Suspicious links
You can spot a suspicious link if the destination address doesnโt match the context of the rest of the email.
For example, if you receive an email from Netflix, you would expect the link to direct you towards an address that begins โnetflix.comโ.
Unfortunately, many legitimate and scam emails hide the destination address in a button, so itโs not immediately apparent where the link goes to.
Source: Malware Traffic Analysis
In this example, you would probably know that something was suspicious if you saw the destination address in the email.
Unfortunately, the rest of the message is pretty convincing, and you might click the link without giving it a second thought.
To ensure you donโt fall for schemes like this, you must train yourself to check where links go before opening them.
Thankfully, this is straightforward: on a computer, hover your mouse over the link, and the destination address appears in a small bar along the bottom of the browser.
On a mobile device, hold down on the link and a pop-up will appear containing the link.
5. The message creates a sense of urgency
Scammers know that most of us procrastinate. We receive an email giving us important news, and we decide weโll deal with it later.
But the longer you think about something, the more likely you are to notice things that donโt seem right.
Maybe you realise that the organisation doesnโt contact you by that email address, or you speak to a colleague and learn that they didnโt send you a document.
Even if you donโt get that โa-haโ moment, coming back to the message with a fresh set of eyes might help reveal its true nature.
Thatโs why so many scams request that you act now or else it will be too late. This has been evident in every example weโve used so far.
PayPal, Windows and Netflix all provide services that are regularly used, and any problems with those accounts could cause immediate inconveniences.
The business depends on you
The manufactured sense of urgency is equally effective in workplace scams.
Criminals know that weโre likely to drop everything if our boss emails us with a vital request, especially when other senior colleagues are supposedly waiting on us.
A typical example looks like this:
Phishing scams like this are particularly dangerous because, even if the recipient did suspect foul play, they might be too afraid to confront their boss.
After all, if they are wrong, theyโre essentially implying that there was something unprofessional about the bossโs request.
However, organisations that value cyber security would accept that itโs better to be safe than sorry and perhaps even congratulate the employee for their caution.
I would also suggest reading my article “what is Spear phishing and how to avoid it”
If you are interested in advanced email security to protect you from phishing and other email threats , I offer Baracuda Email security as a managed solution, feel free to get in touch for a quote.
