How to spot a fake email

There’s an awful lot of cyber crime out there – from computer hacks to online banking raids – and much of it makes use of bogus emails.

Criminals have become very skilled at making fake messages look as authentic as possible, in order to persuade people to reply to them, or click on the web links or attachments they contain. The fraudsters then have access to personal information or the victim’s computer system, allowing them to commit various malicious acts.

So how do you work out which emails are genuine and which should be deleted?

6 things to do if your emails are hacked

Think: why have you received this email?

Before engaging with an email, ask yourself a series of questions to determine who has sent it – and why?

Firstly, do you know and trust the email sender? If the message is from someone you get frequent emails from, it is more likely – but not guaranteed – to be genuine.

Were you expecting the email? Is it a response to a query you remember sending to an organisation or about something you’ve recently bought?

Be very cautious about messages that seem to be trying to worry you into taking urgent action. The most common cons involve emails that appear to come from PayPal or your bank, saying there has been suspicious activity on your account and asking you to log in – via a link. The link is fake, and victims end up providing their banking details to the criminals. If you are worried, close the email and contact your bank or PayPal to check via a different method. 

And remember, banks and companies will never, ever ask for your passwords or account details by email.

Fraudulent emails that appear to come from HMRC are also common. Or an email might claim you have made a high-value purchase online, and provide an apparent link – to an eBay or Amazon account, for example. If you respond to cancel it, ‘malware’ can capture your password.

If the email is offering something that sounds too good to be true – a huge win in a lottery you can’t remember entering, say – then it is a scam email. Delete it immediately.

How to stay safe online

Appearance matters

Visual clues can indicate an email is fraudulent. Check these clues out before you click on a link.

Is the message personalised?

Fraudulent emails are typically sent to thousands of addresses. As a result, they are unlikely to be personally addressed to you. If a message supposedly from a company you have dealt with begins ‘Dear customer’ or just ‘Hello’, the chances are it’s fake.

Does the logo look right?

Criminals might add a bank or company logo to their fake email to make it more convincing. If it looks somehow wrong – it seems pixelated or stretched compared with the company’s official website, for example, or is in an odd position on the page – be on your guard.

Is the email well laid-out?

If it’s supposed to be from a company, it should be clearly and professionally formatted. If the paragraphs or lines are in mismatched fonts, don’t align or are just big blocks of text, proceed with caution.

Are there spelling mistakes?

There could also be obvious grammatical errors in the message, particularly if it’s been sent from abroad. This is a sure sign that the email is not genuine.

Saga Home Insurance provides cover that goes beyond what you might expect. For more information and to get a quote click here.

Is the email written in a suspicious way?

A common recent scam involves personal email accounts being hacked and used to send out requests for emergency cash – for example, as a result of being robbed on holiday.

In general, these messages – although supposedly sent by a friend or family member – read strangely: there is no personalisation or attempt at a genuine greeting. If you are concerned, try to contact the person by other means – even if just to warn them they’ve been hacked.

Beware of buttons

You might be used to clicking on colourful buttons – small images with text written on them – on websites to take you through to another web page, but don’t do so in an unknown email. Fraudsters often include a number of them to entice you to click on a link.

Check the links

Before you click on a highlighted link in an email, check the site you are being directed to actually belongs to the firm from which it claims to come. The simplest way is to contact the company directly – by phone or by your own email – to ask if the email is genuine. Don’t use the apparent contact details held within the email; look them up yourself on Google.

Alternatively, you can hover your mouse (if you’re using a desktop PC) over the link. The web address you are actually being directed to should appear at the bottom of the email or next to the link. On a tablet or smartphone, touch the link and hold it with your finger without clicking on it. An options box should pop up that shows the url of the company. (A ‘url’ is the web address of a company, usually with ‘www’ in it.)

The url may be long and full of strange strings of characters – that’s normal. But the address should begin with https:// followed by the company’s correct web address and then another forward slash (/). For example, https://www.barclays.com/.If the address is instead followed by another dot or a dash, say, you may be directed to a different – possibly fraudulent – website.

Be particularly wary if the address makes no real reference to a legitimate firm.

7 password mistakes

Suspect attachments

In addition to fake links, cybercriminals often use email attachments to hack victims’ computers: simply opening an attachment can instantly compromise your personal information.

In general, banks and retailers will never send attachments, so always treat them with extreme caution.

If someone you know sends an email with an attachment that you weren’t expecting, you should get in touch with them, perhaps by phone – not using
any phone number you don’t recognise provided in their email – to check that they really sent it.

If an attachment file name ends with .exe, this means it is a program that could introduce a virus into your computer, which could then delete your data or copy your passwords. Attachments that end with suffixes such as .jpg, .png (both image files), .pdf, .docx (documents), .xlsx (spreadsheets), and .pptx (PowerPoint presentations) are more likely - but not guaranteed - to be safe.

What to do next

If you have doubts about an email, you can simply delete it. To help your computer filter out future messages, though, you can right-click with your mouse (if on a PC) on the email and choose the ‘mark as spam/junk’ option before deleting it. On a phone or tablet, do this by going to the options list.

If the email is supposedly from a particular company, it would be helpful to  forward it to them so they can warn other customers. Search online for the company’s correct contact information. You can also report suspicious emails to the police-run organisation Action Fraud (0300 123 2040).

Always make sure that your computer’s anti-virus software is up to date – this can help block dodgy emails and attachments.

From the October 2017 issue of Saga Magazine.

Saga Home Insurance provides cover that goes beyond what you might expect. For more information and to get a quote click here.