Spotting Phishing

What is Phishing?

Phishing is a psychological trick. Instead of using advanced mathematics to break into a computer, a hacker simply sends you a fake email or text message that looks incredibly realistic. The message creates a sense of extreme panic or excitement, tricking you into voluntarily handing over your password, credit card number, or money.

Because humans are generally trusting, Phishing remains the single most successful cyberattack in the world. Over 90% of all data breaches start with a simple phishing email.

The 3 Golden Rules to Spot a Fake

You don’t need a computer science degree to spot a phishing attack. You just need to look for these three red flags.

1. The “Urgency” Trap

Scammers know that if you stop to think logically, you will realize the email is a fake. To prevent you from thinking, they create a false sense of immense urgency.

• “Your account will be permanently suspended in 2 hours.”
• “A charge of $899.99 was just made. Click here to cancel it.”
• “You have a final notice from the IRS.”

The Defense: Real companies do not operate this way. If an email makes your heart race and demands immediate action, assume it is a scam until proven otherwise.

2. The Sender’s Address

Scammers can easily change the “Display Name” of an email to say “Netflix Support,” but they cannot easily fake the actual underlying email address.

• Always click on the sender’s name at the top of the email to reveal the raw email address underneath.
• If the email is supposedly from Netflix, but the address is support-team@netflix-help-desk-123.com, it is a scam. A real email will always end in exactly @netflix.com.

3. The Hover Trick

The email will almost always contain a bright blue button that says “Log In” or “Cancel Payment.”

• On a computer: Hover your mouse over the button without clicking it. Look at the bottom left corner of your screen. A small grey box will pop up showing you the true destination of that link.
• On a phone: Press and hold your finger on the button for 2 seconds. A menu will pop up revealing the true website address.
• If the web address is a random jumble of letters, or doesn’t perfectly match the official company website, do not click it.

The Ultimate Failsafe

If you receive a scary email from your bank or Amazon, do not click any links in the email.

Instead, open your web browser, type amazon.com or your bank’s website directly into the address bar yourself, and log in normally. If there is a real problem with your account, there will be a massive notification waiting for you on the official dashboard. If there is no notification, the email was a scam.