Article
Three Ways to Verify the Identity of an Email
frsecure.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
The easiest, and still one of the most effective, ways to protect yourself is to validate the email address identity. “First, hover over the “from” display name to see what email address pops up (to hover, move your pointer over the information that you want to verify).” Still not convinced? If the email is coming from someone you regularly communication with, compare the new message against older ones. Does the display name look the same for all emails? Is the email signature the same?
First, hover over the “from” display name to see what email address pops up (to hover, move your pointer over the information that you want to verify). It’s very common for an attacker to spoof a display name to look like it is coming from someone legitimate, but when you hover over the display name you’ll often find that message is actually coming from someone else. “Does the display name look the same for all emails? Is the email signature the same?” And, lastly, don’t forget to call! There’s nothing like a good old-fashioned, pick-up-the-phone and ask the person if they meant to send you the “I’m stuck in Paris and need money to get out now” message – just make sure you use a phone number from your address book and not one on the potentially suspicious email.
“Attackers are using phishing emails as an easy means to acquire credentials to break into networks or to download malware in order to take control of networks or steal (or ransom!) valuable information.” If you are knee-deep in information security, you might feel like you’ve become a bit worldly-wise about how to detect phishing emails. If you are anything like me, you likely ignore about 70% of legitimate emails from co-workers, friends, and family because they fall into that “look suspicious” category (you know the ones, with a generic subject line like “Check this out!” and only a link to an interesting article in the body of the email).
The easiest, and still one of the most effective, ways to protect yourself is to validate the email address identity. “First, hover over the “from” display name to see what email address pops up (to hover, move your pointer over the information that you want to verify).” Still not convinced? If the email is coming from someone you regularly communication with, compare the new message against older ones. Does the display name look the same for all emails? Is the email signature the same?
The easiest, and still one of the most effective, ways to protect yourself is to validate the email address identity. “It’s very common for an attacker to spoof a display name to look like it is coming from someone legitimate, but when you hover over the display name you’ll often find that message is actually coming from someone else.” Still not convinced? If the email is coming from someone you regularly communication with, compare the new message against older ones. Does the display name look the same for all emails? Is the email signature the same?
First, hover over the “from” display name to see what email address pops up (to hover, move your pointer over the information that you want to verify). It’s very common for an attacker to spoof a display name to look like it is coming from someone legitimate, but when you hover over the display name you’ll often find that message is actually coming from someone else. “Does the display name look the same for all emails? Is the email signature the same?” And, lastly, don’t forget to call! There’s nothing like a good old-fashioned, pick-up-the-phone and ask the person if they meant to send you the “I’m stuck in Paris and need money to get out now” message – just make sure you use a phone number from your address book and not one on the potentially suspicious email.
Some attackers work a bit harder and make it a bit trickier to expose their scam. For these, you need to dig a little deeper. “Many times the attacker will employ a slight-of-hand (like magicians do) so you think you are reading an email address correctly but they’ve actually switched out, added or replaced characters (commonly known as substitution and transposition).” Hopefully, your IT team has enabled Sender Policy Framework (SPF) Records in your email system, but just in case, check the internet header information to see where the email is going to. As an added bonus, this makes for a great party trick and will make all your friends think you are a technical genius!
Some attackers work a bit harder and make it a bit trickier to expose their scam. For these, you need to dig a little deeper. “It’s common to see legit email addresses with an “m” replaced with an “rn”, a lower case “L” switched out with the number “1” or a .com email reading as .co instead.” Hopefully, your IT team has enabled Sender Policy Framework (SPF) Records in your email system, but just in case, check the internet header information to see where the email is going to. As an added bonus, this makes for a great party trick and will make all your friends think you are a technical genius!
Remember when we hovered? Let’s go back to the email that showed up and take a closer look. Many times the attacker will employ a slight-of-hand (like magicians do) so you think you are reading an email address correctly but they’ve actually switched out, added or replaced characters (commonly known as substitution and transposition). It’s common to see legit email addresses with an “m” replaced with an “rn”, a lower case “L” switched out with the number “1” or a .com email reading as .co instead. Even the slightest change in an email address means the email is going somewhere else. “Hopefully, your IT team has enabled Sender Policy Framework (SPF) Records in your email system, but just in case, check the internet header information to see where the email is going to.” To find the properties in an email (using Microsoft Outlook), click File>Properties and look for the “Return Path” or “Reply To” in the Internet headers section
Search “Another great way to find out if a sender is legitimate is to do a search on the email domain – this is especially useful for messages you receive from new contacts or people you aren’t as familiar with.” Verify the domain name ownership and set-up details. Sites like WHOis and ICANN allow you to find out details about when a domain name was set up and often, who the owner of the site is. If a site was created in the last 90 days but the promising new vendor tells you that they’ve been in business for the past three decades, you might want to question the legitimacy of the message.
Still not convinced? If the email is coming from someone you regularly communication with, compare the new message against older ones. Does the display name look the same for all emails? Is the email signature the same? “There’s nothing like a good old-fashioned, pick-up-the-phone and ask the person if they meant to send you the “I’m stuck in Paris and need money to get out now” message – just make sure you use a phone number from your address book and not one on the potentially suspicious email.” Inspect
Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.