Spotting a Spam or Fake Email: Protect Yourself from Phishing Scams

Email remains a primary communication tool, but it’s also a common avenue for cybercriminals to launch phishing scams, spread malware, and steal personal information. Recognizing the signs of spam or fake emails is crucial to protecting yourself and your sensitive data. Here’s how to spot a spam or fake email.

Look Closely:

Impersonation:

• Similar Domains: Scammers often create email addresses that mimic legitimate ones by using domains that are very similar to real company domains. For example, an email address like [email protected] is intended to look like [email protected] at a quick glance. These subtle differences can easily go unnoticed if you’re not paying close attention.
• Small Variations: These variations can include:
  • Adding or changing a single letter (e.g., amazon-support.com vs. amazon.support.com)
  • Using different domain extensions (e.g., .co instead of .com)
  • Adding words or characters that seem relevant (e.g., [email protected] instead of [email protected])

Red Flags:

Urgency as a call to action:

• Creating Panic: Phishing emails frequently use subject lines that attempt to create a sense of urgency or fear. These tactics aim to pressure the recipient into taking immediate action without thinking carefully. Examples include:
  • “Immediate Action Required”: This subject line suggests that there’s an urgent issue that needs to be resolved right away, such as a problem with your bank account or an urgent security alert.
  • “Your Account Will Be Suspended”: This subject line implies that your account will be disabled or suspended unless you act quickly. It preys on the fear of losing access to important services, prompting hasty actions.
  • “Unusual Activity Detected”: This creates concern that your account has been compromised and needs your attention immediately to secure it.
  • “Payment Failure Notice”: This indicates that a recent transaction did not go through and needs your immediate intervention to resolve.
• Psychological Pressure: These subject lines leverage psychological pressure to bypass your usual caution. They make you feel that you must respond instantly to prevent negative consequences.

It’s important to remember that in some cases legitimate emails will also use similar language, for that reason whenever confronted with an email that stresses and urgent response its always advisable to proceed calmly with whatever the subject matter might be.

Where its an option, if you’re still unsure consider using some other channel of communication to check the validity of the message.

With online services, you may sometimes find a “My messages” section when logging into the website. In other instances where possible you might also be able to contact the service provider by phone to verify an issue is legitimate.

Remember, if such an email also contains a URL link to “Secure your account now” to be cautious of clicking on such links, whenever possible visit the website directly so you can be sure you’re visiting the genuine site and not a phishing page.

Dangerous Files:

Unexpected Attachments:

• Surprise Emails: If you receive an attachment that you weren’t expecting, even if it appears to come from someone you know, it’s important to be cautious. Cybercriminals can hijack email accounts or spoof email addresses to make it look like the email is from a trusted source.
  • Verify Before Opening: If you receive an unexpected attachment, contact the sender through a different communication method (such as a phone call or a separate email) to confirm that they actually sent it. This extra step can help you avoid opening malicious files.
  • Context Matters: Consider whether the attachment makes sense in the context of your relationship with the sender. If you haven’t communicated with them in a while or the attachment doesn’t align with your usual interactions, it’s a good reason to be suspicious.

File Types:

• High-Risk File Types: Certain file types are commonly used by cybercriminals to distribute malware and should be approached with extra caution. These include:
  • Executable Files (.exe): These files can directly install software on your computer. If the software is malicious, it can harm your system or steal your data.
  • Compressed Files (.zip, .rar): These files can contain multiple files, including executables and other types of malware. Cybercriminals use compressed files to conceal malicious software.
  • Script Files (.scr, .bat, .cmd): These files can execute a series of commands on your computer, potentially installing malware or altering system settings.
  • Document Files (.pdf, .docx, .xlsx): Even common document files can be dangerous if they contain embedded macros or scripts. PDF files can also exploit vulnerabilities in PDF reader software.
• Signs of Malicious Attachments:
  • Unusual Names: Be wary of attachments with odd or irrelevant names. Malicious files often have generic or mismatched names to deceive recipients.
  • Multiple Extensions: Files with double extensions (e.g., invoice.pdf.exe) are a red flag. The real file type is often hidden by the first extension.
  • Urgent Instructions: If the email urges you to open the attachment immediately, take extra caution. Scammers use urgency to trick recipients into acting without thinking.

Double-Check:

Contact the Company:

• Direct Communication: If you receive an email that seems suspicious or asks for sensitive information, it’s important to verify its authenticity by contacting the company directly.
  • Use Official Channels: Go to the company’s official website and use the contact information provided there. This might include customer service phone numbers, official email addresses, or live chat options.
  • Known Contacts: If you have previously communicated with the company and have saved their contact details, use those instead of any new contact information provided in the email.
  • Check Statements: For financial institutions, you can refer to contact information provided on your official statements or bank cards.
• Examples:
  • Bank Alerts: If you receive an email claiming to be from your bank about suspicious account activity, call the number on the back of your bank card rather than any number listed in the email.
  • Package Delivery Notices: If you receive an unexpected notification about a package delivery, visit the courier’s official website and use their tracking tools or contact information to verify the email.

Don’t Use Provided Contact Info:

• Potential Deception: Cybercriminals often include fake contact information in phishing emails to mislead recipients. Using this contact information can lead to further scams or fraudulent activities.
  • Fake Numbers and Emails: The email might provide a fake customer service number that connects you to the scammer, or an email address that seems official but is controlled by the attacker.
  • Look-Alike Websites: Links provided in the email might direct you to a look-alike website designed to capture your personal information. These websites often closely mimic the design of legitimate sites to deceive users.
• Examples:
  • Phishing Links: An email from “[email protected]” asking you to verify your account details. The domain is slightly different from the legitimate “amazon.com” and can lead to a fake website.
  • Fake Tech Support: An email claiming to be from a software company might provide a phone number that connects you to a scammer who asks for remote access to your computer.

Spotting a spam or fake email and protecting yourself from phishing scams requires a vigilant mindset and a proactive approach. By maintaining a healthy skepticism and pausing to scrutinize each email, you can mentally prepare yourself to avoid the traps set by cybercriminals. Always question unexpected communications, and if something seems off, take the time to verify its authenticity through independent channels. Remember, it’s better to be cautious and take an extra moment to check than to fall victim to a scam. To further fortify your defenses, make use of reliable resources designed to enhance your security:

• VirusTotal (www.virustotal.com): Scan suspicious attachments and URLs to detect malware and other threats.
• URLVoid (www.urlvoid.com): Check the safety and reputation of websites before visiting.
• Have I Been Pwned (www.haveibeenpwned.com): Check if your email has been compromised in data breaches.
• PhishTank (www.phishtank.com): Verify if a link is a known phishing site.
• SpamCop (www.spamcop.net): Report spam and phishing emails to help others stay safe.

By adopting these practices and leveraging these tools, you can significantly reduce the risk of falling victim to email scams and keep your personal information secure. Stay alert, stay informed, and always think twice before clicking on links or downloading attachments from unknown or suspicious sources.