Phishing Emails – No, Not Fishing Emails.
They are the “Nigerian Prince” swindle of this decade. Despite our best efforts via enews, meetings, calls, and support tickets, if there is one question we get at Network Medics on a weekly basis – it’s about phishing emails. Since the dawn of the first spam email on May 3, 1978, the spammers are always changing their tactics and in a cat/mouse game with spam filtering providers. Thankfully, filters at this point are good and eventually catch up even within a few hours.
What are phishing emails?
The good ones are a type of social engineering where the email coyly strives to get important information from you by appearing legitimate to your every day life. While some of these messages are so outlandish they are obvious, others can be a bit more convincing. For example, an email that appears to come from your CFO asking for an immediate money transfer – that you would be responsible for.
In my opinion, this prays on small businesses and nonprofits the most. This is because they are more apt to not have proper process layers in place to avoid it. Such as having 2 people sign off on a wire transfer. Thankfully, we are finding banks are now helping directly and indirectly by asking more questions, requiring process or signoff, and going after a scammer when possible.
So how do you tell the difference between a phishing email and a legitimate message? Unfortunately, there is no single way that works in every situation, but there are a number of things that you can look for. Here are 5 ways I usually suggest to spot ‘em.
Phishing emails contain poor spelling, formatting, and grammar.
How often does a professional send you an email that fails so bad at spelling and grammar it looks like a 2nd grade paper? Probably not often. My business partner would say that I fail grammar in my blog posts (ha ha), but with email, bad grammar is a common way to spot phishing emails. Phishing emails are generally only 2 sentences or less. Since most 2-3 sentence emails are written for a request or action, it requires very rudimentary grammar or context and if written poorly its a massive red flag.
Phishing emails do not contain your corporate email signature.
It is important that from mobile phones to outlook you have standard corporate signatures. Your marketing or a PR firm like CELPR will help with keeping your corporate identity standards across the board. This is a simple method as email scammers do not attempt to use email signatures and it will not be included. If they don’t take the time to use spell check, they likely will not take the time to make your signature look right. Yes, mobile device signatures have to be simple, but it doesn’t mean it cannot be held to a standard. I recommend using a 3rd party or custom coded email signature created by a professional. Due to access it is hard to mimic exactly and is an even easier way to help spot a phish attempt. It is like having a Twins player show up with a cheap jersey from a retail store – the referee (you) will spot it easy.
Phishing emails can include a threat, esp. from your superior.
Here is the actual body text of a recent email I reviewed. “Hey emily, this is john,,, please wire $50.000,00 immediately to [this address] by 3pm or you will be out job. -j” This email is obviously awful, but the phisher got the relationship correct between the two employees. On LinkedIN, it is very easy to see who may be reporting to you which is why it is important to review your LinkedIN security settings. Your financial department is likely targeted first as its where the score is. Do you think your organization is too small to matter? No. Most often, their software pulls the details of your relationship, is relatively automated, so it doesn’t matter.
Phishing emails comes from a different email domain.
This can be a little bit more complicated, but if the email comes from say, accounts[at]usbank2you.com, it’s a good sign you have a scan in front of you. However, phishers are getting good at “spoofing” or making the email appear to come from your actual domain itself. This is where the ways listed above are even more important.
Phishing emails can appear to come from a financial, enterprise, or government agency.
Does your bank ever ask you over email to go to a website to enter your social security number? Negative, definitely not. Does the IRS email you about issues with your return and you need to send them X dollars to stay out of jail? Yah, nope. Does Microsoft ever email you about a Windows 10 license? Not often, but if they do email you about a change to an Office 365 account you have to log into their website to do anything. The rule of thumb is if you get any email about disclosing your personal or financial information, do your homework or just ignore it. The chances of legitimacy are insanely small. Also, if it is legitimate, you would likely get a follow up email from the sender – which never comes from a phisher at this point in history from my experience.
Overall, you are strong and smart – I can tell – because you landed on our website and are simply looking into this phishing email issue. Therefore, use that sound noggin and gut of yours on an email that just doesn’t feel right. As a born and bred Minnesotan, I know if a road looks shiny it is icy. Slow down, check your snow tires, and leave the scam artists on the side of the road – so to speak.
As always, as your authentic managed it service provider, we want to discuss this with you and answer any questions you have. Whether its in our regular meetings, a help desk ticket, or a call to customer service – its best to be safe then sorry. We’re here to help if you are not sure on any email that you receive.
Written by:
Kevin Calgren
Partner of Network Medics
Minnesota Business IT Consultant
Questions about
