Received an Unexpected Email?

Why Email Remains a Primary Attack Vector

Despite decades of awareness campaigns, email remains the #1 way cybercriminals reach victims. Why? Because it's easy to fake, can look extremely professional, and people check email constantly throughout the day.

In 2024, over 3.4 billion phishing emails were sent daily, with business email compromise (BEC) scams resulting in losses exceeding $2.7 billion in the U.S. alone.

Common Types of Email Scams

How to Verify Email Authenticity

1. Check the Sender's Email Address Carefully

Don't just read the display name - click to see the actual email address. Scammers use tricks like:

• Lookalike domains: "paypa1.com" instead of "paypal.com" (1 instead of l)
• Subdomain tricks: "paypal.secure-login.com" (not owned by PayPal)
• Similar spellings: "amazn.com" instead of "amazon.com"

2. Hover Over Links (Don't Click)

Before clicking any link, hover your mouse over it to see where it actually goes. If the URL looks suspicious or doesn't match the claimed destination, don't click.

3. Look for Generic Greetings

Legitimate companies usually address you by name. "Dear Customer" or "Dear User" is a red flag.

4. Check for Urgency and Threats

Scammers create artificial urgency: "Account will be closed in 24 hours!" "Urgent action required!" Legitimate organizations give you time to respond.

5. Examine the Language Quality

Poor grammar, spelling errors, awkward phrasing, or inconsistent formatting are warning signs.

6. Verify Requests Independently

If an email asks you to take action (reset password, confirm payment, etc.):

• Don't use contact info from the email
• Go directly to the company's official website or app
• Call using a number you find independently
• Ask if they sent the email

7. Be Suspicious of Attachments

Never open attachments from unknown senders. Even seemingly harmless files (PDFs, Word docs) can contain malware.

8. Check Email Headers

Advanced users can examine email headers to see the true origin. Most email clients let you view "full headers" or "original message."

Red Flags That Signal a Scam Email

• 🚩 Unexpected email from a known company or person
• 🚩 Urgent or threatening language
• 🚩 Requests for personal or financial information
• 🚩 Generic greetings ("Dear customer")
• 🚩 Poor grammar, spelling, or formatting
• 🚩 Suspicious links that don't match claimed destination
• 🚩 Unexpected attachments
• 🚩 Too good to be true offers
• 🚩 Sender's email address doesn't match official domain
• 🚩 Requests to bypass normal procedures
• 🚩 Mismatched or fake company logos
• 🚩 Asking you to act before verifying

What to Do If You Receive a Suspicious Email

1. Don't click any links or download any attachments. This is critical to staying safe.
2. Don't reply to the email. Responding confirms your email address is active.
3. If it claims to be from a company you use: Don't use any contact information from the email. Go to their official website directly and log in or contact them independently.
4. Mark it as spam/phishing. Most email services let you report phishing. This helps protect others.
5. Delete the email. Don't keep it around where you might accidentally click it later.
6. If you're not sure: Use our email analysis tool below to check the sender's information and see if others have reported issues.
7. Report it: Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and to the FTC at reportfraud.ftc.gov.

What If You Already Clicked or Responded?

If you clicked a link but didn't enter information:

• Close the browser immediately
• Run a full antivirus scan
• Monitor your accounts for unusual activity
• Change passwords for important accounts

If you entered personal information:

• Passwords: Change them immediately on the real site, enable two-factor authentication
• Financial info: Contact your bank/credit card company immediately
• Social Security number: Consider placing a fraud alert with credit bureaus
• Report identity theft: Visit identitytheft.gov for recovery steps

If you sent money:

• Contact your bank or payment service immediately
• Report to local police and FBI at ic3.gov
• If you paid with a credit card, dispute the charge
• If wire transfer, contact the transfer company (though recovery is difficult)

If you downloaded an attachment:

• Disconnect from the internet immediately
• Run full antivirus/anti-malware scans
• Change passwords from a different device
• Monitor accounts for unauthorized access
• Consider professional IT help if malware is detected

Protecting Yourself from Future Email Scams

Use Email Security Features:

• Spam filters: Keep them enabled and mark suspicious emails as spam
• Two-factor authentication: Enable on all important accounts
• Email verification: Use services that verify sender authenticity (SPF, DKIM, DMARC)

Practice Good Email Hygiene:

• Don't publish your email address publicly
• Use separate emails for different purposes (shopping, banking, personal)
• Unsubscribe from unwanted mailing lists
• Don't forward chain emails

Stay Educated:

• Keep up with latest phishing tactics
• Train family members to recognize scams
• When in doubt, verify independently

Use Security Software:

• Keep antivirus software updated
• Use anti-phishing browser extensions
• Keep your operating system and software patched