Identifying Phishing and Scam E-Mails

We've received a few e-mails from staff around the district asking about e-mails they have received and whether or not they were real.  So I decided to write a blog post on a few ways to identify a fake e-mail.

 The following is an actual e-mail received by a staff member:
---------------------------------------------------------------------------------------------

From: Miranda Killian 1
Sent: Thursday, October 10, 2013 2:16 PM
To: Miranda Killian 
Subject: IP Security Alert!! 2

This Message is From the Admin Help Desk 3. Due to our latest IP Security upgrades we have reason to believe that your E-mail account was accessed by a third party. 4

Protecting the security of your E-mail account is our primary concern; we have limited access to sensitive E-mail account features.

To resolve this issue you have to Re-validate your e-mail account. Failure to Re-validate your E-mail account as soon as you see this message will cause the deactivation of your E-mail account be warned. 5

Help Desk requires you to validated your email account by clicking HERE 6

Thank you for your cooperation.

Admin Help Desk 2013 © 3

---------------------------------------------------------------------------------------------

When I see an e-mail like this I break it down in my head, similar to diagramming a sentence.  Here is my thought process:

1.  Identity

The first thing I look at is who sent it.  Do I know this person/company?  Was I expecting this e-mail?  If you know for certain they're not part of your organization or a company you can't identify, then this is a red flag.  At a large organization it's hard to know every person that works there, so this can be difficult.  Try using a staff directory to be certain.  Don't reply to the e-mail and ask that person, of course they will say yes!  Ask someone you know for sure works for your organization.

2. Bait/Hook

The subject will often try to catch your attention by throwing out buzz words.  While this is also the case for legitimate e-mails, please use caution.  In this case these words are not used correctly and make no sense to a person who is tech savvy.  If they make no sense to a tech savvy person, they will definitely not make sense to a less tech savvy person.  Don't let tech words make you complacent.

3. Validation/Credibility

They will try to provide credibility by throwing out terms/titles that seem important.  This puts you at ease and makes you want to trust what you read after this.  Often it will be vague and not make sense.  Notice this does not mention any organizations?  Don't be afraid to do research on a search engine.  Others may have already seen the exact hoax e-mail you received.  They will often reword the body of the e-mail, but if you search for the subject or something like "Admin Help Desk 2013", you'll see results flagging this as a phishing scam.  This is where #4 comes in to make you ignore your reasoning ability.

4. Reason

They give you a reason (in this case scare tactic) why you should trust what they're telling you.  They may also entice you to trust them by promising money, items, or some other incentive.  If it's too good to be true, it is.  Greed and fear motivate people to do things they would not normally decide to do.

5. What do they want?

This is the most important part of these e-mails to pay attention to!  This is where they tell you what they want or what you need to do.  In this case they want you to "re-validate your e-mail".  Now if you followed the e-mail up until now, they're hoping you put little thought into this part and do not ask questions.  What are they REALLY getting from me? My e-mail and password.  This is the reason for the whole e-mail and should be your main concern.

6. Their Solution

They want you to visit a link and provide information.  Do not do it!  Links can easily be faked to look legitimate (hover your mouse pointer over the link and it'll show the actual website in the bottom bar of your browser). If someone informs you of a problem you didn't know you had, but has a solution handy, be suspicious (infomercials/telemarketers anyone?)!  If you were not expecting an e-mail, most legitimate organizations will give you instructions on how to change your password or validate your account by visiting the website (without using a link).  If you initiated a password reset or were expecting an e-mail confirmation from an organizations, then you know you the purpose of the e-mail.

Hopefully this thought process helps you in deciphering what's real and what's fake.