THE MAIN DANGERS IN EMAILS: IDENTIFY THEM AND PROTECT YOURSELF

Share

Tweet

Share

Share

Email

Web criminals send billions of emails every day. The volume of messages is staggering and spam/phishing accounts for 85% of total email traffic worldwide. As many as 8 billion fraudulent emails in a year.

One silver lining in this massive amount of data is that 99% of cyber attacks require human interaction to succeed, resulting in malware installation, wire fraud, inadvertent data disclosure, and more. The message itself is not enough but an error on the part of the recipient is necessary!

While scam emails are designed to trick you into cooperating, it is still your responsibility to recognize their intent. Think twice when you enable a macro, open a file, follow a link, or open a document. Your caution could save you and your company a load of inconvenience and costs.

Elements that need to be considered when receiving an email, before taking any action:

The first element of evaluation is to read the content well. The title of the message and the body of the message must not raise “alarm bells” in us. Impersonal greetings (instead of your name, hello or sir/madam), non-fluent grammar, imitations of authoritative sources but with “smudges in the lexicon”, creation of a sense of “urgency” in the response (if you do not do what has requested immediately you consequences) or an unusual request (such as sending money to a friend who says he can’t reach you in any other way) are all elements that should push us to carry out further checks. Tip: Look for grammatical errors, not spelling errors. When creating phishing messages, scammers often use a spell checker or translation machine, which gives them all the right words, but not necessarily in the right context. To be safe, however, let’s proceed with the next point.

The second element of evaluation is the presence of links in the message. If there are links, never click right away. We need to understand: a) whether the written link and the destination link coincide. A trick at the basis of every link fraud is to disguise the link with a word or name of a domain that we already know but to “land the unfortunate person on a different site”. b) if the link is to a site we already know, if it is very similar or if we have never seen it before. We must therefore evaluate the domain name. For example, we all know, or we hope, that “Paypal” has a domain extension of .com and not .org or anything else. So if we remember the name of a site we can immediately make a comparison. If in doubt, it’s best to check carefully before accessing. Hover over the link with the mouse if we are using a computer or hold down a long tap on the link to make the extended domain name appear on the device (be careful if we are not familiar with tapping with a finger on the phone, it is better not to proceed but to wait to evaluate the link with a computer when we return home). Even if the link seems authoritative, we still proceed with the next point before opening it or we use some free analysis tools: check the security of a website or link before accessing

The third evaluation element is the presence of an attachment. The reasons for receiving an attachment can be very few for a private user but can be many for a company employee. We recommend that you never open an attachment unless you are fully sure that the message is coming from a legitimate party. Even then, you should still look for something suspicious in the attachment. For example, if you receive a pop-up warning about the legitimacy of the file or the application asks you to change settings, do not proceed. Or contact the sender through an alternative means of communication and ask them to verify that it is legitimate. It is also important to never open an attachment without first having scanned it with a good antivirus (and by good antivirus, we mean a paid antivirus). Particularly if the file extensions are not what we usually expect in the emails we receive every day. We know this operation could be a significant waste of time but a security scan really makes a difference.

The fourth evaluation element is the sender’s address and the presence of other copied contacts. Some may wonder why this control isn’t higher on our list. Well, perhaps only some know that the sender is easily falsifiable and therefore should not be considered an absolute control value but rather a relative one and to be used as an overall evaluation that we are ready to carry out. Let’s check who the sender really is. First of all, no legitimate organization will send emails from an address ending in “@gmail.com”. The best way to check an organization’s domain name is to type the company name into a search engine to see its email. So be careful if the sender’s domain name is misspelled. Further questions to ask in the case of a private sender are: do we know him? …does he have a reason to write to us even if we know him? … have we ever written to that address or received emails from that address before? We also pay attention to the fact that we are copied on the email received with others, so ask ourselves if the same email was sent to more than one person… All elements that should make us raise our guard if they don’t match, that is: we don’t know the sender; we know him but we don’t expect emails from him; we have never written to that address even though the person’s name apparently belongs to a friend; it’s the first time we’ve received a response from that sender… Even if everything seems correct, we don’t stop and continue with the next verification step.

The fifth element of evaluation is in the signature of the message. Usually, fraudsters, in emails that must appear to be sent by companies, cut the signature of the message so as not to allow contact elements to appear that are not the same email. Therefore we will find ourselves faced with messages without nominal references (name and surname of the person sending the message) without telephone numbers and without information on privacy which usually closes the letters to comply with the provisions of the law. Is everything in order? Here too we continue our checks, arriving at the next point.

The sixth element is our intuition. That is, listening to what our intuition or sixth sense wants to communicate to us… if an element has “appeared” in our head even just once that has made us doubt… like “but is it true?” or “I have to trust” … well then don’t do anything before looking for more confirmation.

We have therefore learned that reading a dangerous email is not enough to risk something. The risks begin if we open the attachment, click the link, or respond by providing our personal data. So we can easily open the email and analyze it in search of the clues described above.

As a final consideration, we invite readers to pay attention to a further problem that is emerging massively: that of blackmail by email.

Blackmail by email, i.e. an email requesting payment in bitcoin in which you are told that you have been “caught” visiting adult sites or they write that your device has been hacked by hackers and they have access to your operating system. They also say that they have already downloaded all the confidential information from your browsing history and that they have installed a virus on your computer (a trojan or malware) through which they would have had access to the webcam and managed to film you in intimate acts. If the user does not pay a ransom of x dollars in bitcoin (the digital currency) within 48 hours, the criminals will spread the images to all his contacts, therefore friends, relatives and work colleagues. If you have received this email, please know that it is a scam. Read this article before requesting assistance for a possible fraud “Hackers have access to your device. Check the details soon! : THREAT COMING FROM YOUR OWN EMAIL” So stay calm as the criminal doesn’t have any footage at all; do not pay any ransom: paying it would mean receiving further threats and requests for money; change your email password, choose a particularly complex one and activate two-factor authentication; follow many other useful tips proposed on the “decalogue of good online surfers” page [click here] and protect your phone or computer video camera by reading this article Video Blackmail: when the webcam or camera really spies on you [click here ] because even if the communication of blackmail via email is usually a fraud, it is still technically possible to install malware on your computer that records you without your knowledge (in the article on blackmail videos indicated above we show you how to avoid being victims of Camfecting and RAT or Remote Access Trojans, processes in which an attempt is made to hack into a person’s webcam and activate it without their permission).https://www.analisideirischinformatici.it/servizi/ricatto-sessuale/