Terms used in this article:
Cybercriminals: An individual or team of people who use technology to commit malicious activity using electronics.
Phishing: A fraudulent attempt to obtain sensitive information (usernames, passwords, credit cards etc.) through electronic communication.
Sending Domain: Each email sent has an address of where it is going and where it came from. A sending domain is the from address of which it originated from.
Social Engineering: An attack avenue that relies heavily on human interaction and manipulation to gain access to computer devices, computer networks or physical locations.
Spear Phishing: An email or electronic communication scam that targets specific individuals, organizations or businesses for malicious purposes.
What are Spam Emails?
Spam emails, sometimes referred to as “Junk Emails”, are unsolicited electronic messages sent in bulk through various emailing platforms. The term “Spam” funnily enough, originated from a Monty Python sketch in which spam, the commonly recognized luncheon meat, was viewed as repetitive and an unavoidable product. This repetitive and unavoidable concept easily described unwanted emails eventually coining the term “Spam Email”.
Why would anyone send a spam email? There are many reasons why someone would send you a spam email and you might be surprised who is behind it. You have the run of the mill cybercriminals, hoping you click on a bad link to gain access to your account information to sell or abuse it in a malicious fashion. Then you have sneaky advertisers or companies looking to gain marketing information through the links you click on in hopes to target you for directed advertisement.
Although technology is consistently advancing as we enter the year 2020, spam and phishing emails are on the rise, consistently pestering both consumers and IT professionals alike since the early 90’s. As spam emails are here to stay in the foreseeable future, let’s take a look at 3 simple steps you can take to protect yourself or your organization against spam while utilizing your email services.
Step 1: The Senders URL (From Address)
Before opening any email, lets make sure it is coming from a trusted source. In this step, we will be utilizing Microsoft’s Outlook Services to receive our email.
In the photo above, we have outlined in orange where the incoming email originated from. Inside of this orange rectangle, we have the sending domain outlined in a red rectangle (sometimes you must left click on the name to view this sending domain). This sending domain (in our example: PartnerNetwork@email.microsoft.com) is an easy tell-tale sign whether you should be interacting with this email. If the sending domain, sometimes referred to as the “From Address”, looks unusual or not familiar, it is general best practice to not interact with that email until you have verification that it is indeed a legitimate email.
Step 2: Grammatical or Spelling Errors
This is very common in phishing email attempts and can be easily spotted to a trained eye.
As seen in the photo above, this email has an interesting sending domain display name of “Abuse”. This is our first red flag and should be investigated further before interacting with the email as in Step 1. The next thing we see in this email, is a high volume of grammatical errors throughout. This is our second red flag and we should be very cautious before interacting any further.
Most email service platforms include some form of auto spell check which indicates to us this email may have derived from a mass mailer outfit. The best corrective action is to inform your IT service provider of this sort of incoming spam for future corrective measures. If you are on a personal email, block the incoming sending domain and delete this email from your inbox.
Step 3: Impersonation Using Social Engineering
Imagine it is 3pm on a Friday, you are already planning out your weekend and an executive at your company you have never spoken to sends you an email stating that they need three $50 iTunes gift cards by 5pm with no questions asked. What do you do?
This happens more often than you may realize. This type of email impersonation would be classified as “Spear Phishing”. It is a highly targeted researched attack that involves a cybercriminal to impersonate an executive playing on the emotions of lower ranking employee in hopes they act irrationally to please the higher ups for self-promoting benefits. When receiving such emails, you need to ask yourself, is this normal behavior within our companies’ culture?
In this case, it wouldn’t hurt to email your supervisor asking if this is indeed a task that needs to be completed or contact your IT service provider to verify its authenticity. Remember do not click on any links within this email until it has been verified as an authentic email.
While many more types of spam or phishing email schemes exist, these are some of the most common that our team at Whatcom IT, Inc. run into while assisting our business clientele. We hope these 3 easy steps will help you identify future spam emails during your normal email workflow.
If you have any questions, concerns or would like to learn more about Whatcom IT services to help protect your organization against spam emails, please feel free to reach us at firstname.lastname@example.org.