Are you being phished by email?
“A phishing email is an email that appears legitimate but is actually an attempt to get your personal information or steal your money” (Microsoft Support, Phishing and Suspicious Behaviour)
This IT Tip will share ways to identify suspicious emails and how to report a phishing case.
Red Flags in Suspicious Emails
The content below has been adapted from KnowBe4 resource, Social Engineering Red Flags.
From:
- The email is from someone inside K or from a vendor, or partner and the email is very unusual or out of character.
- You don’t have a business relationship nor any past communications with the sender.
- The email is from someone outside of K and it’s not related to your job responsibilities.
- The email is from a suspicious domain (like micorsoft-support.com)
To:
- You were copied on an email sent to other people, but you don’t personally know the other people it was sent to.
- The email was also sent to an unusual mix of people within your organization. For example, a group of people who last names start with the same letter.
Date and Subject:
- The email was sent at an unusual time like 3 a.m. and not during regular business hours.
- The subject line is irrelevant or does not match the message content.
- The email message is a reply to something you never sent or requested.
Attachments
- There is an attachment that you were not expecting or that does not make sense in relation to the email message.
- There is an attachment with a possibly dangerous file type such as:
- ZIP and RAR Files
- DOC and DOCX
- XLS, XLSX, XLSM
- IMG, ISO, etc.
Hyperlinks
- The biggest red flag – When you hover over the hyperlink to preview the URL and the link-to address is for a different website.
- The email only has long hyperlinks with no other information.
- The email has a hyperlink with a misspelling of a known website such as www.bankofarnerica.com (in this case the “m” is really two characters, “r” and “n.”
- The sender asks you to click a link that seems odd and/or illogical.
Content
- The email is out of the ordinary, has bad grammar, and/or spelling errors.
- The sender asks you to click a link or open up an attachment that seems odd and/or illogical.
- The sender asks you to click a link or open an attachment in order to gain something of value or avoid a negative consequence.
- The email claims to have a compromising or embarrassing picture of yourself or someone you know.
Tips for checking a link without clicking on it
Simply hover over the link and look at the bottom left corner of your computer screen for the full URL the link actually goes to.
How to Report Phishing Attempts
The easiest way to report phishing emails is through the Report message option in Outlook which can be found in different locations depending whether you’re using Microsoft Office Outlook or Outlook.com.
The following information was retrieved from the “How to report a phishing scam” section on Microsoft’s “protect yourself from phishing” documentation.
Microsoft Office Outlook
With the suspicious message selected, do the following:
- Choose Report message from the ribbon
- Select Phishing.
This is the fastest way to report it and remove the message from your Inbox. It will also help Microsoft improve their filters so that you see fewer of these messages in the future.
Webmail at outlook.office.com
Select the check box next to the suspicious message in webmail. Select the arrow next to Junk, and then select Report phishing.
Note: If you’re using an email client other than Outlook, start a new email to phish@office365.microsoft.com and include the phishing email as an attachment. Please don’t forward the suspicious email; as it needs to be received as an attachment so the headers on the message can be examined.
Have Questions?
For more Microsoft documentation please visit the Phishing and Suspicious Behaviour page through Microsoft Support. Additionally, please feel free to email Help.Desk@kzoo.edu with more specific questions related to phishing emails.
Suggest an IT Tip
If you have a topic that you would like us to cover in the future, please complete the IT tip suggestion form or email, Katrina Frank at Katrina.Frank@kzoo.edu directly.