How do I know if my email is Dangerous?

Here at ESP Projects in Sheffield we have been listening to the questions we get asked by our customers and we have chosen a few topics we are going to explore in more detail. One of the common questions we have been asked recently is, How do I know if my email is Dangerous?

In this blog we explore just that – So grab and coffee and have read.

It’s crucial that end users have some knowledge of what to look out for when receiving email to ensure they aren’t caught with spam and scams and compromise their security. I have broken down some key points in what to look out for to ensure you are vigilant and able to spot when an email is dangerous.

1. Unknown Sender

If you receive email from an unknown sender or the address seems suspicious or slightly misspelled, this is a good indicator that it is some form of spam. Also check on unexpected email if the email address matches the display name of the sender. We see a few examples where spammers use the name of an actual staff member. So you’ll see and email from “Colleague Name” Where the email address is “541256@gmail.com” which is a giveaway that this email isn’t really from that colleague.

2. Unexpected Attachments or Links

Always be wary of links which claim to take you to a password reset or saying your password will expire “Click here to reset it”. Microsoft will never email you with things like this so be sure not to click them and report them to us at ESP to get the senders blocked.

If you ever need to reset your Email/Microsoft account password, you can contact ESP, or you should be able to reset it yourself by going directly to portal.office.com and finding security/password settings in your account page there.

3. Generic Greetings

Emails that start with generic greetings like “Dear Customer” instead of your name could be suspicious. There are always marketing emails etc which lots of companies send which will do this, you need to be wary of these when they appear to come from someone you do business with. Anything pretending to be banking, your phone/broadband provider, or any service you have an account with, should be able to address you by name when emailing you. Always err on the side of caution with anything starting with generic greetings.

4. Urgency or Threats

Emails warning your account is going to be suspended unless you click a link are almost always spam. Microsoft will most often urge you to contact your administrators rather than send any sort of link for this. Anything else will generally send you polite notifications that this needs to be done well in advance and you are always best going directly to the site or service and logging in there than clicking any links on emails.

Be wary of any sort of threatening language or anything pushing urgency or requesting a quick reply or action to be taken to avoid account issues, especially if you haven’t initiated anything or had any involvement with the sender previously.

5. Spelling and Grammar Errors

Most service providers that you will receive email from meticulously spell check before sending anything. If you receive anything from Microsoft for example this will never have spelling errors in it.

People do make mistakes of course and your colleagues may send you emails with spelling mistakes in, but you can generally tell with the structure of sentences and the way it’s written whether it’s really from someone you regularly email or not.

For emails from new senders or people you don’t receive from very often, it’s always best to be cautious and read carefully to ensure nothing seems out of place in the language, spelling, or grammar.

6. Requests for Personal Information

If any email asks for sensitive information, it’s very likely spam trying to get your details. Double check the senders’ details and you will likely find something else amiss with it, following that you can send it on to ESP and we will dig into it to get the sender blocked.

Equally If a colleague asks for any personal information unexpectedly, check and double check with everyone involved, via a method other than email that this is a genuine request before divulging anything. Your colleague’s email could be compromised or targeted to get this information from you.

7. Check the URL

If there is a link in an email from an what appears to be an expected sender, it’s always best to check the target before you click by hovering your mouse over the link and you will see the target URL.

If the link says www.microsoft.com but the URL says http://www.Jimthespammer.com this is a masked URL and you know not to click that link, these can sometimes be very subtle so it will link to http://www.micros0ft.com for example, which is still absolutely spam, just more difficult to spot at a glance.

8. Spoofed Websites

Be cautious if the email directs you to a website that looks like a well-known site but has a slightly different URL. Like the last point www.micros0ft.com, Check the website’s SSL certificate (look for “https://”) and ensure the site is secure. Did you notice in the last point that the “s” in https:// is missing on that one?

A subtle difference to look out for on the URL’s but an important one, https:// means the site is secure and certified, any legitimate email from companies should always have this on websites they link to.

9. Unusual Requests

One we have seen a rise in lately, people posing as a company CEO (using the Display name on a different email, like in point 1) and requesting staff purchase amazon vouchers and send them over. They often start with “can you do me a favour discreetly, don’t speak to anyone about it” and then follow with these requests once they have you believing they are who they say they are planning a surprise or something. Always check with the requester, sender, finance, managers as many people as you can check with, preferably outside of emails before agreeing to any request out of the blue, especially where money is involved.

10. Emails with Unusual Attachments

It’s common for scammers to pose as companies and say “please open our weekly newsletter” or something similar then you click the attachment, and it runs some form of malware in the background that can compromise your security. You will often see the email address doesn’t match the sender on emails like this so hopefully you’ll spot it before clicking any attachments. Good practice it to never open unexpected attachments at all or if it appears to be from someone you know but you weren’t expecting the attachment. Check with the sender by another means of communication if possible, or if you can only contact them by email, ask a few questions so you get a response which will allow you to gauge the legitimacy of the sender and if they are who the email address shows.

11. Verify with the Sender

Noted a few times already through this article, if you receive something unexpected, but it appears to be from someone you do have contact with. It’s always worth double checking, spammers find ways to appear as other senders so if you can check an unexpected email is from who it says it is, it’s always worth taking this step.

12. Use Security Software

A good anti-virus will screen downloads on your computer, even if they are hidden in attachments or links in emails. Your best defence is always to be vigilant and cautious, but it’s crucial to have security software which will stop any malicious software before it can install in case you do click something without realising it’s not legitimate.

13. Phishing Filters

We have complex filters built through 365 to protect against many types of phishing email. Phishing email in brief is when a scammer uses email to trick the receiver into giving them information such as log on details. We see phishing email in the form or password expiry emails posing as Microsoft. For example, they warn your password is going to expire, click here to reset it, then you click the link which goes to a site which looks a bit like a Microsoft site but isn’t really. Then if you are convinced, you enter your details, but instead of resetting the password, when you enter your current one it sends it off to the scammers database which can then use it to access your emails and send out more spam from your email address in the hopes of catching more data or scamming your contacts using your email address. This is why we stress how crucial it is to be very cautions of links in email and avoid clicking any if possible.

14. Check the Signature

A signature doesn’t just look neat and professional, it can also be a good indicator that an email is legitimate. Signatures often have full contact details and branding and if it includes links, we can see by hovering over them if they link to the secure sites they claim.

If an email comes from a company you would expect to have a signature but doesn’t be on guard, double check, you may spot something out of place, a lack of signature or a signature with little or no detail can be an indicator they aren’t who they claim to be.

15. Trust your Instincts

If something feels off, it probably is. Trust your instincts and always err on the side of caution.

Remember, the best defence against dangerous emails is a combination of vigilance, awareness, and good security practices. ESP will always be happy to help if you have any queries about the legitimacy of an email. We’d rather get an email questioning something you have received, than an email warning you’ve been compromised, and we need to investigate a security issue.

As always, we are on hand and happy to help with any queries about this or any other security concerns you may have.  Click below to book a chat with one of our team and see how we can help keep you safe!