Tips on How to Identify a Phishing or Spoofing Email

Tips on How to Identify a Phishing or Spoofing Email Hover over Friendly From Probably the easiest way to identify if an email is legitimate or not, is to simply hover your mouse arrow over the name in the From

Tips on How to Identify a Phishing or Spoofing Email

1. Hover over Friendly From
   Probably the easiest way to identify if an email is legitimate or not, is to simply hover your mouse arrow over the name in the From column. By doing so, you will be able to tell if the email is from a recognizable domain that is linked to the actual sender name. For example, an email from Match.com should typically have the from domain of “match.com” (not “motch.com” or “humbletemper.com”).
2. Are the URLs legitimate?
   Continuing on with the theme of hovering over certain parts of the email, another place to check would be any URLs the email is directing you to visit. You will always want to make sure the link is legitimate. However, in order to be extra cautious, it is best practice to always open a new window and go to the site directly without using the email link provided in an email.
3. Incorrect grammar/spelling
   A common practice of many hackers is to use misspelled words on purpose. While it may seem that this would easily reveal an illegitimate email, it is actually a tactic used to find less savvy users. Spammers have learned that if they get a response from a poorly written email, they are on to an easy target and will focus their efforts to bring that user down.
4. Plain text/Absence of logos
   Most legitimate messages will be written with HTML and will be a mix of text and images. A poorly constructed phishing email may show an absence of images, including the lack of the company’s logo. If the email is all plain text and looks different than what you’re used to seeing from that sender, it is best to go with your gut feeling and ignore the message.
   
5. Message body is an image
   This is a common practice of many spammers. Make sure the email is a good mix of text and images. Also, there may be embedded links for you to hover over within the image for an extra step of precaution.
   
6. Request for personal information
   One tactic that is commonly used by hackers is to alert you that you must provide and/or update your personal information about an account (e.g., Social Security number, bank account details, account password). Phishers will use this tactic to drive urgency for someone to click on a malicious URL or download an attachment aiming to infect the user’s computer or steal their information.
   
7. Suspicious attachments
   Is this new email in your inbox the first time your bank has sent you an attachment? The majority of financial institutions or retailers will not send out attachments via email, so be careful about opening any from senders or messages that seem suspicious. High risk attachments file types include: .exe, .scr, .zip, .com, .bat.
   
8. Urgent/Too good to be true
   If an email seems too good to be true, it most likely is. Be cautious with any message offering to place money into your bank account by simply “clicking here”. Also, if the content places any kind of urgency as far as “you must click into your account now”, it is most likely a scam and should be marked as “junk”.
   
9. Is my email address listed as the From address?
   If you notice that your email address is being identified as the From address, this is a sign of a fake email message. Along those same lines, if the To field shows a large list of recipients, you should also be cautious. Legitimate emails will most likely be sent directly to you and you only. You may see “undisclosed recipients” and this is something to keep an eye on as well. It could be a valid send, but double check by using the other tips identified above.

Email Phishing, Email Spoofing