Updated August 2019:
Phishing emails attempt to gather personal information such as passwords, account information or credit card numbers. The emails appear to be from a legitimate source – your bank, internet or email provider, or a business that you may have a credit card on file with. They are often designed to mimic the appearance of a legitimate business including company email addresses and logos. But with a closer look, you can often spot phishing emails from some of the characteristics listed below.
In any email that you receive, you should never click on a link in an email in which you are not 100% sure that the email came from the identified sender – and you know and trust that sender. If in doubt, contact them by typing their website address into your web browser and look for contact information on their website. No legitimate company will ask for a password or financial information via an unsolicited email or phone call.
In the example above there are several characteristics that identify that the email is a phishing attempt:
- Grammar – notice the sentence “Please you are to fill in the below informations to validate…”
- Punctuation – Look for words that should/should not be capitalized, periods and commas in the wrong place, spaces that should/should not exist. Analyze it like your school English teacher would.
- “From” – When hovering over the “From” address, it displays “web_upgrade2dsk@…” A legitimate email will be come from addresses such as “info@[company].com” or “customerservice@[company].com”. However the email address that it’s coming from should not be your only determination whether or not an email is real since an email address is easy for spammers/hackers to spoof.
- “To” and greeting – The email shown is addressed to “undisclosed recipients” and “account owner”. – A company that you already do business with will send an email addressed to your email address and name.
- A scare tactic – “Failure to follow this process … result in loss of important information”.
- A sense of urgency for immediate action – “…exceeded the set storage limit”
- Personal/private information – A company that you do business with already knows your name, email address, password, etc. Unless you are logging into your account on their official website, they would not ask you to enter it into an email or web form and send it back to them.
In the above example from “AOL” above, what characteristics do you see that it is a phishing email? Please post a note in the comments below.
More information:
Spammers and scammers hacking email accounts to get addresses (Includes an official-looking phishing email from “Yahoo”) – Computer Techs
Protect your information: Phishing, Pharming, Vishing, and Smishing – Information from Intuit Online Security Center