One of the most important things you can do to stay safe on the Internet is to be careful while reading email. That’s because online criminals know that we’re all busy, and we often don’t pay enough attention to what we’re reading or where we’re clicking.
To take advantage of our inattention, these Internet information thieves forge email messages to look like they come from the likes of Apple, Facebook, and Amazon, along with well-known banks, payment services, retailers, and even government agencies. Even more dangerous are messages that appear to come from a trusted individual and include personal details—these messages are often targeted at executives and company managers or tailored by someone who is after your information specifically. Generally speaking, these attacks are called phishing—you can see examples here.
The goal? Get you to click a link in the message and visit a malicious Web site. That site usually continues to masquerade as being run by a company or organization you trust. Its aim is to sucker you into revealing confidential information by asking you to log in, pay for a product or service, or fill out a survey. The site—or an attachment in the email message—might also try to install malware.
Although phishing is a huge problem that costs businesses hundreds of millions of dollars every year, these warning signs can help you spot suspicious messages. Their absence does not prove an email is legitimate:
- Be suspicious of email messages, particularly from people you don’t know or from well-known companies, that ask you to click a link and do something with an online account.
- Look closely at email addresses and URLs. On a computer, you can hover the pointer over a link to inspect its destination without clicking. A lookalike such as paypa1.com instead of paypal.com is a warning sign. But a familiar address or official-looking domain is not proof: senders can be spoofed, and scammers can send messages from compromised legitimate accounts.
- Watch out for highly emotional or urgent requests. They’re designed to make you act without thinking. Take any such messages with a grain of salt.
- Poor grammar, misspellings, or odd phrasing can be warning signs, but writing quality cannot authenticate a message. Scams can be polished, and genuine messages can contain mistakes. Verify unusual requests through a phone number, official app, or website you already know is genuine.
So what do you do if you get a message that may be phishing for sensitive information? Most of the time you can just ignore it. If you’re worried that it might be legit, instead of clicking any links in the message, navigate to the site in question manually by typing the organization’s URL into your browser—use a URL that you know to be correct, not the one in the email message. Verify unexpected requests with the person or organization through a phone number or contact method you already know, and use its official app or a website address you know is correct. Do not use contact details supplied by the unexpected message. Whatever you do, do not open attachments that you aren’t expecting and never send confidential information via email.
If you think you’ve fallen prey to a phishing attack and given away a password, you’ll want to change passwords on any affected accounts, and any websites where you also use the same password. If you’ve opened any attachments or approved any installs, run anti-malware software to determine whether your Mac has been infected. And remember, regular backups protect you from a multitude of sins.