3 Crucial Stages for Spotting Smart Spoofed Emails
Spoofed emails are a major problem for everyone with an email address. For financial marketers where the platform is so popular, having a strategy for safeguarding email correspondence is pivotal for maintaining integrity. Especially when the industry is the most targeted by scammers; 33% still lack enforcement policies to stop spoofing.
Email spoofing is a cyberattack against businesses to encourage users to open and interact with an email’s material (attachments and links) that are malicious, possibly in order to steal sensitive account details or deploy malware or ransomware.
It does so by using sender addresses that have been forged to gain trust. After creating bogus addresses, scammers can dupe a recipient using modified fields and content. This is getting tougher to spot too, with accurate AI-generated content and polymorphic phishing: creating variations of successful attacks and dodging spam filters by never appearing the same way twice.
While most email providers and companies can detect risk using email security and authentication protocols such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC, they’re not comprehensive and are still frequently targeted as weak links – particularly with lax SPF records of DKIM failures.
Lookalike domains, or compromised legitimate senders may not be picked up, unless for some intelligence from human users. Here’s how to spot spoofing in three stages.
Check Who It’s From
The most obvious spoof-sign is when the “from” domain does not match that of the legitimate organisation, which scammers attempt to mask in many ways:
Free email accounts, including Gmail and Outlook, will often be used alongside unrecognisable services.
Sly misspellings of these common domains are worth double checking.
Similar deviations from expected senders may be used too, including ‘paypal-mail-server.com’
Check for irrelevant sub-domains such as ‘paypal.example.com’ or ‘paypal.com.qweqwe.example.com’ where only the ‘example.com’ part matters.
Clever typography can be implemented, such as ‘ ‘páypal.com’, or more cleverly an ‘r’ and ‘n’ used to mimic microsoft, like ‘rnicrosoft.com’.
Identical foreign characters – ’a’ in English or ‘a’ in Cyrillic – can be implemented, and are tough for email clients like Gmail, Outlook and Apple to pick up.
If a domain is not exactly as you’d expect, it’s likely fishy and well worth double checking for errors and deviations on standard formats.
Scan Email Content for Spam Techniques
If a display name differs from the sender’s email address, that’s a red flag – large companies are typically consistent with their formats, whereas spammers should stand out for their inconsistencies:
Without the original email domain, spammers will use their own in the reply-to address – if it’s different, then it may be illegitimate.
If the reply-to address is a free email service (even from a legitimate domain) then be suspicious.
Check for email addresses to reply-to that may be included in the email body.
Spoofers will create a sense of urgency in subject lines and within the email body – “We’ve Suspended Your Account” etc – to cause hasty decisions and replies.
Any indication of ‘Click Here’ in the email body will circumvent any need to reply and can directly take you to an infected page.
Details in email signatures that misalign with what you know about the sender (i.e. a phone code in a different country or state to their location) is suspect.
You can easily discover a reply-to address by hitting ‘Reply’, but just do not send anything!
Utilise Authentications
The email header for the ‘Received’ line should match the email address displayed in the email.
Check if an email header has passed SPF or failed (i.e. spf=softfail)
If using DKIM and DMARC authentication results should indicate whether the email passed requirements.
For all the modern techniques spammers use, utilising a mix of security policies and manual vigilance is usually enough to keep cybercrime at bay. Take the time to assess and maintain authentications to be up-to-date, and keep a close eye on the common spoofing signs and your domain should remain secure.
