Malicious actors are constantly devising new methods to deceive unsuspecting individuals into disclosing their sensitive information or credentials. The rise of generative AI tools like ChatGPT, Gemini, Bard, and others has enabled these bad actors to craft more articulate, elaborate, and convincing messages.
However, phishing emails often still contain telltale signs if you know what to look for. Here are some key features to help you identify phishing emails:
- Phishing emails often come from suspicious or slightly altered email addresses that mimic legitimate sources but may have slight variations, such as extra numbers, misspelled domain names, or unusual characters.
- Phishing emails often use urgent or threatening language to prompt quick action without thinking—such as claiming your account will be locked unless you act immediately, or your MFA token will expire soon.
- Phishing emails typically request sensitive information like passwords, social security numbers, date of birth, or financial details. Outside of applying for credit, SSN’s, DOB, and financial details should never be shared. Passwords should never be shared—no legitimate organization will ask for your password.
- Phishing emails may include unsolicited attachments, downloads, or QR codes that could contain malware or viruses. Bad actors know that many users are willing to open attachments or scan a QR code without thinking twice. And often, links are embedded that will lead the user to a malicious page or a page that requests the users’ username and password.
- Phishing emails often lure recipients with offers that seem too good to be true, such as lottery wins or free gifts. Even though the Nigerian Prince scam has been around for decades, some form of it is still used today. People still genuinely believe that they can inherit millions if they just pay a small fee.
Additional Items to Consider:
Hovering over links in phishing emails may reveal mismatched URLs or redirects to suspicious websites.
- Although this is true in many cases, this is not the best indicator to use as bad actors can often leverage legitimate links to redirect a user to a malicious page. And adversely, many legitimate advertisers may user third party platforms for tracking purposes that may not immediately indicate that the link leads to their website.
All phishing emails contain spelling and grammar errors, suggesting a lack of professionalism.
- This was more common before the days of the AI boom. Bad actors can now create well crated emails with no mistakes. In fact, they can write emails that look flawless with just the appropriate tone and structure.
Takeaway:
By staying vigilant and recognizing the common signs of phishing emails, you can protect your sensitive information and avoid falling victim to these increasingly sophisticated scams. Always scrutinize suspicious emails carefully before taking any action.
