Phishing attacks are becoming increasingly common and sophisticated. One of the best ways to defend against them is to be able to spot them.
The message is not personalised:
When a user receives an email that does not address them directly by name or refer to them as a "dear user" or "dear customer", beware. Phishing emails often use general greetings in an attempt to appear more widespread and suspicious than they really are.
These emails are usually sent out en masse as part of a massive automated
campaign. Phishers usually only have a list of e-mail addresses and the idea is
not to find out whose name it is, but to entice as many people as possible to
click on the links in their message.
The e-mail address of the sender does not correspond to the organisation:
This is a fairly simple way to spot a phishing attempt. If the user receives an email claiming to be from their bank, but the email address it comes from is something like mabanque@gmail.com, justineapfens@bourssoraama.com then it is pretty clear that something is wrong.
Organisations will not send official communications from a Gmail or Hotmail (major operator) address. They will always use their own domain name (e.g. boursoramabanque.com) So if the email comes from anything other than an organisation's official domain, it's a huge red flag.
There are grammatical errors or typos in the email:
If the user receives an e-mail that is full of grammatical errors, typos or generally looks badly written, this is a good indicator that it is phishing.
Phishers often send their emails quickly and without much care or attention to detail, so if an email looks like it has been sent in a hurry, without regard to spelling or grammar, it is probably a phishing email.
The message is urgent or includes a sense of urgency:
Phishers often try to create a sense of urgency in their emails in order to get people to act quickly without thinking. They might say "your account is about to be closed or that you need to act quickly now to avoid some sort of negative consequence, such as deleting the box, your email account data, etc.
Of course this is not true. Hammerers just want to create a sense of urgency so that the person clicks on the link without thinking. So if an e-mail contains language that tries to create a sense of urgency, beware of it.
The e-mail contains attachments:
If the user receives an e-mail with an attachment that they were not expecting, they should be very careful before opening it. This is another common phishing attack tactic.
If the user was not expecting an e-mail with an attachment, he should be very careful before opening it. If they do not know the sender or if the email looks suspicious, they should not open the attachment. They should notify their IT provider and delete the email.