Inspired by James Veitch’s comedy series on replying to spam emails, I chose phishing as a standalone topic from social engineering given its sheer economic impact. 90% of data breaches are caused by phishing, and Australians alone lost $489 million from phishing scams in 2018. In particular, phishing is such an important area to improve security literacy because attacks are often geared towards those with a lack of technical know-how.
6 key things to check for with an unexpected/unusual email:
- Bad spelling and grammar: Your friends making typos is one thing, but if an email is supposedly official business communication (often mimicking a company template), one major red flag is when there’s clear spelling and grammar mistakes. PayPal’s legal and marketing team have probably scrutinised the copy of their emails relentlessly. Some random dude in a non-English-speaking country trying to make a quick buck? Perhaps not.
- Unrecognised sender address: If their email domain looks somewhat similar to a familiar company but does not follow the same format e.g. [email protected], be very wary. This is a classic case of spammers trying to imitate a legitimate company.
- Sense of urgency/necessity: Fraudsters will often create a false sense of urgency, whether through time-bound conditions, threats or instilling fear. This is because sending users into a state of panic leads to rash decision making and reduces careful perusal of the email’s red flags. Examples include supposed data breaches, accounts being locked, and mandatory password changes.
- Generic greeting: A business with which you have an account/existing relationship is a lot less likely to use Dear Customer or Dear Member as the opening to the email. Not a dealbreaker, but certainly a warning sign.
- Unsolicited attachments: Often, phishing emails will ask you to download a file like a .zip file to review account details or update your password. This is a dead giveaway; legitimate businesses would not request sensitive information in this manner. Even without such requests, unexpected attachments may well contain malware.
- Unusual address when hovering links: Be sure that any hyperlinks in the email actually link to the address typed. A safe way to check this is to hover over the link with the mouse and see the URL that pops up. With phishing emails, this will often be a very different URL. Do not click through!