Recognize phishing red flags

Phishing is the primary attack method in the cybercriminal’s playbook

Did the email use a generic salutation such as "Dear Customer" or nothing at all? Service providers usually know who you are and typically personalize emails with your name and the last few digits of your account number.

While generic greetings can still be a warning sign, modern phishing attacks may use publicly available information or data from previous breaches to create highly personalized messages.

Legitimate businesses typically proofread their communications. While spelling mistakes and awkward wording can still be warning signs, many modern phishing attacks use AI-generated content that appears polished, professional and free of obvious errors.

If you hover your mouse over a website link, you’ll see the actual destination of the website you’re about to visit (on some mobile devices you can accomplish the same thing by holding your finger on the link for a second or two). If that location differs from the way the link is written in the email, it’s a good indication of an attack. Be especially cautious of shortened URLs, unexpected redirects and QR codes that direct you to websites without clearly showing the destination.

If you don’t know the sender, or receive something from a friend that looks suspicious, don’t open the attachment. If it is from someone you know, you can always pick up the phone and give them a quick call to make sure they actually sent the email. Unexpected file-sharing requests, document collaboration invitations or software downloads should be treated with the same level of caution as traditional email attachments.

Be suspicious of requests for sensitive information such as user IDs and passwords, financial account numbers, health information or Social Security numbers. Be particularly cautious if the sender requests passwords, multi-factor authentication (MFA) verification codes, financial information or account recovery details.

The sender is someone you do not know, and the email address is one you’ve never seen before or looks different than it should. Remember that phishing emails can also originate from compromised legitimate accounts. A familiar sender does not automatically mean a message is safe.

A person representing a company or entity sends an email asking for information they should already have. Cybercriminals often impersonate trusted brands, executives, coworkers, government agencies or technical support representatives to create a sense of legitimacy.

Sometimes phishing emails are sent to a lot of people. Other times you see something like "undisclosed recipient list" in the "To:" field. Both are potential red flags.

Messages of an urgent nature, or requesting an immediate call to action, are a common method used to rush people into making mistakes and is another good indicator of phishing. Common examples include requests to reset a password immediately, verify an account, approve a payment, purchase gift cards or provide sensitive information.

Be cautious if someone asks you to provide a one-time passcode, MFA approval, password reset confirmation or other security verification information. Legitimate organizations typically do not request these codes through email.

Phishing attacks do not only arrive through email. Be cautious of unexpected text messages (smishing), QR codes (quishing), social media messages and collaboration platform messages that request sensitive information or direct you to unfamiliar websites.

• Do an online search to make sure a company exists and the contact information they provide — such as address and phone number — is correct.
• Try to do an online people search via LinkedIn or Google to verify that the person sending the email works at the company listed.
• Navigate the company’s website in a browser to see whether the URLs in the email match up. If they do, the email is probably safe.
• If you do business with the company, use your own contact information to verify that the email you received is legitimate. Call them directly!
• Always use a known phone number, website or trusted communication channel when verifying a request. Do not rely on contact information included in the suspicious message itself.
• Ask someone you know at work whether they recognize the company and/or person who sent you an email.
• If the message involves a financial transaction, account change, password reset or other sensitive action, obtain independent verification before proceeding, even if the request appears to come from someone you know.