Ever received an email from eBay asking you to verify your account? Or from Gmail warning you to login otherwise your account will be suspended? How many times have you gotten a supposed Paypal email asking reactivation because your account has been hacked?
If you dismissed the email and simply deleted it, good for you. But if you opened it, clicked and accessed the link, and tried to login to the website, congratulations, you have just become a victim of an unfortunate phishing attempt!
Phishing (pronounced “fishing” as in “fishing for information”) is a type of deception designed to steal one’s personal data such as credit card numbers, passwords, account login information, etc.
The phishing email usually looks like an official letter from a trusted source, such as a bank, credit card company, payment processor, or online merchant. Phishing emails normally direct recipients to a fraudulent website where they are asked to provide personal information. This information is then used for identity theft.
6 Items to Check if an Email is a Phishing Email
Here are six (6) things to look for if you think an e-mail message is a phishing scam.
1. Suspicious email subject
Most phishing emails alert you that something is wrong with your account, and email subject headings are used to entice you to open the mail and follow instructions outlined in the email. Most phishing emails usually use any of the following subject headings.
- Account Alert
- Account Incident
- Account Issue
- Account Renew
- Account Review
- Account Suspended
- Avoid your account or credit card suspension
- Check your account
- Confirm that you are the real owner of this account
- Confirm your bank account
- IMPORTANT: Your account has now been suspended and may be terminated
- Notification of account update
- Notification of Unclaimed Parcel
- Password Change Required
- Protect your bank account
- Restore your account access
- Second (third) notification
- Steps to remove limitation
- The Security of your account
- Unauthorized access report
- Unauthorized account access
- Update your xxxx account
- Verify your xxxxx account
- Warning – Your email account will be closed
- Your account might be compromised
- You have successfully updated your password
- Your email requires verification
- Your profile has been updated
2. Sense of urgency in the letter
Phishing emails usually use the line, “If you don’t respond within 24 hours, your account will be closed.”
These types of messages convey a sense of urgency forcing you to act immediately without thinking. They want you to quickly click and visit the link and access your account in the fake site. Don’t fall for this trap.
3. Unofficial email address
Some senders of phishing mails merely use a generic email address from, say, Gmail or Yahoo. That’s why you might receive a supposed PayPal warning which came from paypalwarning@yahoo.com or an email about your eBay account sent by ebay@free-email.com.
Instinct should tell you that since the email did not come from the official email address of the company, it might not be a genuine email. Genuine Paypal’s emails, for instance, should come from their official email address xxx@paypal.com, and eBay’s email should come from xxx@ebay.com or any other official email addresses they are using.
4. Masked URLs
Some phishing scammers, however, spend some time and effort to change the email information to make it look like it was sent from the official email address of the company. This practice is called “masking” — that is, the link looks like a trusted site’s official link but the actual URL or landing page has been masked and is different. In short, the link you visually see does not take you to the actual website address but to somewhere different, usually to a fake website.
Two examples of this “masked URL” technique is shown below. You will see that the links appear to direct you to the websites of Paypal and eBay. However, what you see is not always right!
- www.paypal.com (Looks like paypal.com but embedded URL is pavpal.com)
- www.ebay.com (Looks like ebay.com but embedded URL is ebav.com)
If you hover or rest your mouse pointer on the links above, you’ll be surprised to see that the links actually go to a different URL! (By the way, we do NOT encourage you to click the link. These are just for illustration purposes.)
5. Unspecified recipient
Phishing messages are usually sent out in bulk and often do not specify your first or last name. Normally a phishing email’s opening line is a generic “Dear Customer” or “Dear valued customer” greeting. If you receive an email with such opening or greeting line, this should alert you that the email you’re reading could be a phishing email.
6. Spelling or grammar errors
A legitimate company would take time to proofread its email so that no spelling or grammar error appears in the email. Senders of phishing emails are usually not concerned with that.
How to protect yourself from phishing emails
Almost all legitimate companies will never ask you to provide your personal or account information. If you received an email supposedly sent by your bank, credit card, PayPal, eBay, etc., confirm with them by going to the official website and contacting them using the company’s contact information. Do not simply click on any links you see in an email.
Also never open any attachment in an email sent by people you do not know. It might contain an executable (.exe) file that will unleash a trojan, virus, or malicious software that will steal your data or hack your accounts.
You can also copy parts of the suspicious email you got and search for it in Google. You’ll most likely see if other other sites have already given warning that the email you received is a phishing email.
Stay safe and don’t be a victim of these scams!
