Top 3 Red Flags of Phishing

Check the sender’s email address to evaluate the legitimacy of an email. If you receive an email from an unknown sender or someone outside your organization, verify the domain to ensure it is trustworthy. Hackers often try to mask a false domain by including additional letters, characters, or misspellings.

If the domain looks authentic, consider your business relationship with the sender. If the email communication seems out of character or unexpected, that is a phishing red flag.

Along with the sender’s email address, it’s also important to scan the recipient section of the email. If the sender has cc’d a random or unfamiliar group of people, it is likely a mass phishing attempt.

Creating a sense of urgency or fear is one of the most used tactics that social engineers use to spark an immediate, irrational reaction from employees. Stressor email subject lines or content are important phishing red flags. Hackers use stressor language to get unsuspecting employees to share sensitive information, make a payment, or engage with links or attachments that contain malware.

For instance, hackers may spoof communication from your business’ CEO asking an employee to quickly make a payment or provide their login credentials to facilitate an urgent business transaction.

Social engineers may also use other forms of stressor content to deceive employees, such as warning of an account shutdown if a payment is not received. These urgent requests for action are specifically designed to manipulate employees’ emotions so they make rushed decisions.

Besides stressor language, another potential red flag of phishing is content with poor spelling or grammatical errors.

Hackers will often send out phishing emails with malicious links. Social engineers create the illusion of an authentic website domain by including subtle misspellings or additional characters to trick email recipients into clicking on a dangerous link.

Another major phishing red flag is when the hyperlink displayed in the email is different from the website that it is linked to. Employees should hover over hyperlinks to ensure the destination aligns with the displayed text.

Cyber criminals may also use email attachments to distribute malware. If the attachment does not make sense in the context of the email’s subject or content, employees should refrain from downloading it. Further, email attachments with suspicious or unexpected file types could also be carrying malware.