Ideas to Help Detect Email Scams
By this point, most us have seen email scams in our inbox. Most likely, we even have a smirk when we spot that email from out-of-the-country asking for a wire money transfer. Lately, many of these scammers are pretending to be businesses or vendors that we frequent. So, how do we tell if an email is legitimate or a scam?
The sender email address is misspelled or misleading.
Look closely at the details. A missing letter in the address or very miniscule changes indicates the email is not from the official business. Study the sending address, and make sure that the parts before and after the @ symbol are accurate.
Grammatical errors in the email.
Misspelled words, improper use of the language, or improper use of punctuation are subtle indications of a scam.
Bad formatting in the body of an email.
Blank lines, broken text, odd spacing, or incomplete formatting indicates a scam.
Beware of “winning a prize” or a “deal” that is too-good-to-be-true!
If the email congratulates you and indicates you have been selected to win a prize, it is most likely a phishing scam seeking to gain information about you and your account.
Attachments or links.
Clicking on any attachments or links in a suspicious email may execute a malicious virus or malware. In most email applications, you can hover your mouse cursor over a link and a small pop-up window will display the true destination of the link. Always hover over links in email before clicking to make sure they take you to the correct and safe destination! This example shows a link posing to be Docusign.com but, it directs you to a malicious site!
When in doubt, don’t click on the link. Instead, go to the sender’s known web address or call the sender at a known telephone number other than what may be specified in the email.
Requests for payment or personal information.
Never initiate a payment or provide confidential information based on an email without independent, verbal verification.
Examples:
You receive an email that appears to come from a vendor informing you of new payment instructions.
You receive an email that appears to come from someone in your organization that instructs you to urgently initiate a payment or provide confidential or personal information.
Business Practices and Safeguards
Preventing business email compromise requires a series of practices to strengthen the organization’s security position. The following are items to consider:
Educate employees on how to recognize phishing emails and how to practice good cyber hygiene.
Develop rigid payment authorization processes with financial personnel using various confirmation methods that perhaps include written or verbal confirmation.
When in doubt, any suspicion of a malicious or fraudulent email should be reported to your IT professional for analysis.
A Note Regarding Communication from the IRS
The IRS initiates most contacts through regular mail delivered by the United States Postal Service, not through email.
The IRS does not:
Call to demand immediate payment using a specific payment method such as a prepaid debit card, gift card, or wire transfer.
Demand that you pay taxes without the opportunity to question or appeal the amount they say you owe.
Threaten to bring in local police, immigration officers, or other law-enforcement to have you arrested for not paying. The IRS also cannot revoke your driver’s license, business licenses, or immigration status. Threats like these are common tactics scam artists use to trick victims into buying into their schemes.
All payments to the IRS should be to the “United States Treasury”.
