As the volume of security threats from email continues to increase and become progressively more malicious, we wanted to arm you with some quick tips and techniques to help protect yourself and your business.
Consider this: according to Symantec’s 2015 Internet Security Threat Report*, “Email continues to be an effective delivery vehicle for spam, phishing, and malware, and overall, the proportion of emails that include malware is rising.”
Here are 10 easy-to-follow guidelines to help you thwart attackers and maintain the integrity of your data:
1. Hover over the "From" column
One of the easiest way to identify if an email is legitimate or not, is to simply hover your mouse arrow over the name in the “From” column. Or, in Microsoft Outlook, turn on the Reading Pane so you can preview the message and its’ sender. By doing so, you will be able to tell if the email is from a recognizable domain that is linked to the actual sender name. For example, an email from Match.com should typically have the from domain of “match.com” (not "motch.com" or “humbletemper.com").
2. Are the URL's legitmate?
When in doubt, don't click the link! Continuing on with the theme of hovering over certain parts of the email, another place to check would be any URLs the email is trying to get you to visit. You will always want to hover over the link to make sure it is legitimate and uses encryption (https://). However, in order to be extra cautious, it is best practice to always open a new window and go to the site directly without using the email link provided in an email.
3. Incorrect grammar/spelling
A common practice of many hackers is to use misspelled words on purpose. While it may seem that this would easily reveal an illegitimate email, it is actually a tactic used to find less savvy users. Spammers have learned that if they get a response from a poorly written email, they are on to an easy target and will focus their efforts to bring that user down.
4. Plain text/absence of logosMost legitimate messages will be written with HTML and will be a mix of text and images. A poorly constructed phishing email may show an absence of images, including the lack of the company’s logo. If the email is all plain text and looks different than what you’re used to seeing from that sender, it is best to go with your gut feeling and ignore the message.
5. Message body is an imageThis is a common practice of many spammers. Make sure the email is a good mix of text and images. Also, there may be embedded links for you to hover over within the image for an extra step of precaution.
6. Verify suspect requestsIf you are not sure if a request is valid, do not open the email or click on any links, and contact the DP Solutions Service Desk for review and recommendations at 410.720.1220 or email@example.com.
7. Request for personal informationOne tactic that is commonly used by hackers is to alert you that you must provide and/or update your personal information about an account (e.g., Social Security number, bank account details, account password). Phishers will use this tactic to drive urgency for someone to click on a malicious URL or download an attachment aiming to infect the user’s computer or steal their information.
8. Suspicious attachmentsIs this new email in your inbox the first time your bank has sent you an attachment? The majority of financial institutions or retailers will not send out attachments via email, so be careful about opening any from senders or messages that seem suspicious. High risk attachments file types include: .exe, .scr, .zip, .com, .bat.
9. Urgent/too good to be trueIf an email seems too good to be true, it most likely is. Be cautious with any message offering to place money into your bank account by simply “clicking here”. Also, if the content places any kind of urgency as far as “you must click into your account now”, it is most likely a scam and should be marked as “junk”.
10. Is my email address listed as the “From” address?If you notice that your email address is being identified as the “From” address, this is a sign of a fake email message. Along those same lines, if the “To” field shows a large list of recipients, you should also be cautious. Legitimate emails will most likely be sent directly to you and you only. You may see “undisclosed recipients” and this is something to keep an eye on as well. It could be a valid send, but double check by using the other tips identified above.
We hope you find these tips helpful in keeping your business safe. If you have any questions or concerns, please feel free to contact us at firstname.lastname@example.org or call our Service Desk at 410-720-1220.
*“2015 Internet Security Threat Report”; Symantec Corporation; April 2015; Volume 20;