A Practical Guide to Identifying Phishing Emails

Phishing is becoming an ever more common way for people to get in trouble when using the Internet. A phishing attack is some communication, usually an email, that tries to lure you into revealing login credentials, financial information, or other confidential details.

A State of Phishing report from security firm SlashNext claims that there were more than 255 million phishing attacks in 2022, a 61% increase from the year before. Luckily, according to the Verizon Data Breach Investigations Report for 2022, only 2.9% of employees click through from phishing emails, but with hundreds of millions of email addresses targeted, the raw numbers are still high. We’ve been noticing—and hearing from clients—that phishing emails are also slipping through spam filters more than in the past.

To help you avoid falling prey to phishing tricks, check out our example screenshots below from real phishing emails, complete with annotations calling out the parts of a message that give it away. All phishing emails are trying to lure you into clicking a link or button to a website that will encourage you to enter your password or other confidential information. Once you realize that a message is a phishing attack, you won’t get suckered into clicking a link or revealing your personal information.

Fake Password Expiration Scam

Our first example is a password expiration scam—it’s trying to get you to click a button to keep your password from expiring. What’s ironic about this scam is that passwords should never expire—forcing users to change them regularly is terrible security practice. If a password is strong and unique, there is no reason to change it unless the site suffers a breach. Let’s look at what identifies this message as a phishing attack.

  1. Note that the Reply-To address is generic and doesn’t match either the email domain used throughout the message or even a major email service provider, which would never send such a message.
  2. Using your email address instead of your name is something scammers do to make the message seem personalized. If this email really came from your IT support staff, they’d be more likely to use your name or leave the email address out. And they’d never send such a message either.
  3. The body of the message uses likely words, but they don’t quite sound like a native English speaker wrote them. The phrasing is slightly off, and quoting words like “send and receive” while not quoting the button name feels strange.
  4. Be careful of things that look like buttons—we’re trained to click them without thinking. In many email apps, you can hover the pointer over a button or link to see where it will go. If you look at the URL at the bottom of the window, you can see that it’s completely different from any other domain listed—a clear sign that this is a phishing message.
  5. “See full terms and conditions” is a strange thing to say in a password-expiration message. What terms and conditions could possibly apply? This is an example of someone who’s not a native English speaker throwing in random phrases they’ve seen elsewhere.
  6. The copyright line is a similar tell. No organization would go to the effort of claiming copyright on a simple support message, and even if it did, it would use its name, not “Email server.”

Spurious Account Access Scam

Our second example pretends to be alerting you to a sign-in to your email account, with the goal of trying to scare you into resetting your password. Frankly, this phishing email stands a good chance of fooling people. You have no way of knowing if your account has been compromised, and if it were compromised, resetting your password is the right thing to do. However, never click through from an email to change a password! You can’t tell if you’re on the right site. Instead, navigate to the site manually, log in, and then change the password. Persuasive though this message is, it does make some mistakes.

  1. The capitalization of “Mail” in the Subject and this line should give you pause. Most people wouldn’t capitalize the word, or they’d refer to something more specific, like your “Gmail” or “Outlook” account.
  2. Another slight strike against this message is the specificity in the timestamp. There’s no reason to include the seconds or the time zone, and most normal people wouldn’t.
  3. There are three mistakes in this line that could tip off a savvy Internet user. It claims to provide the IP address from which the sign-in occurred, but real IP addresses are four sets of numbers from 0 to 255. This one has five sets of numbers, the first of which is way too high at 719. The missing space before the parenthetical makes it look wrong, and finally, the parenthetical claim that the IP address is located in Moscow is overdoing it by invoking scary Russian hackers.
  4. Note that the “reset your password” link doesn’t have an underline, unlike the other two links. Again, that could happen in a legitimate message, but it’s another slight tell. Hovering over the link reveals the fleek.ipfs.io URL at the bottom—clearly nothing associated with your email account and a dead giveaway.
  5. A line saying “Please do not reply to this message” is commonplace in transactional messages, so it makes the message seem more real, but a real warning from an IT department would want to make sure you could contact the support staff.

Fraudulent DocuSign Confirmation

Our final example pretends to be confirmation of a document that you’ve already signed in DocuSign. That’s more clever than trying to get you to sign a document (which we’ve seen in other phishing messages) because most people won’t sign something without looking at it carefully. But you might want to see what document this message is talking about and be suckered into clicking through. What’s trickiest about this message is that it has merely changed some of the text in a real DocuSign message, so someone familiar with DocuSign might think it was real. But there are always giveaways.

  1. The Subject line of this message is a tell because its grammar is atrocious.
  2. The Reply-To address should also ring warning bells because it’s so generic that it couldn’t possibly go with an organization with which you were signing documents.
  3. The yellow line claiming that the email has been scanned for viruses will likely seem unusual to you—even if an email app presented such a message, it likely wouldn’t do so in the body of the message.
  4. There’s nothing wrong with the View Completed Documents button, which looks exactly as it would in a real DocuSign message. However, hovering over it reveals the URL at the bottom, which has nothing to do with docusign.net.
  5. Someone familiar with DocuSign messages might notice that there’s no email address under “Administrator,” as there should be. But that’s a long shot, we know.
  6. As with an earlier example, personalizing with an email address is a definite tell. A real person would have entered your name there, if anything.
  7. Once again, the phrasing isn’t what a native English speaker would say, but even more problematic is how it asks you to sign the enclosed file, whereas the text and button in the blue box say that the document is completed. The mismatch is a complete giveaway.

We didn’t have room to show the rest of this message, which adds to the verisimilitude by continuing to copy text from a real DocuSign message. The two remaining tells further down are links that are empty when you hover over them and an unknown name in the fine print at the bottom, which reads (bold added for emphasis):

This message was sent to you by sefanya maitimoe who is using the DocuSign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.

Overall Advice

Let’s distill what we’ve seen in the examples above into advice you can apply to any message:

  • Pay close attention to emails that are very simple, like our second example above, because there’s less they might get wrong.
  • With legitimate-looking messages copied from large firms like DocuSign or PayPal, pay special attention to unfamiliar names and email addresses.
  • Don’t click anything in an email unless you’ve given it a close-enough look that you’re sure it’s legitimate. It’s too easy to skim and click without thinking, which the scammers count on.
  • Read the text of messages with an eye for capitalization, spelling, and grammatical mistakes. Scammers could write correct English, but if they don’t speak the language natively, they’re likely to make mistakes.
  • Evaluate any claim about something happening within your organization against what you know to be true. It’s always better to ask someone if passwords need to be reset or accounts are being deactivated instead of assuming a random email message is true.
  • Fight the urge to click big, legitimate-looking buttons. They’re easy to make and hard to resist, but if you can preview the URL under one before clicking, it will often reveal the scam.
  • None of our examples fell into this category, but if an email message is just an image that’s being displayed in the body, it’s certainly fake.

Stay safe out there!

(Featured image by iStock.com/Philip Steury)

Protect Your iPhone Passcode by Using Face ID or Touch ID

This is troubling. Joanna Stern and Nicole Nguyen of the Wall Street Journal have published an article (paywalled) and accompanying video that describes attacks on hundreds of iPhone users in major cities throughout the United States. Some attacks involve drugging people in bars or even violence, but the most avoidable involve the thief or a confederate surreptitiously observing the iPhone user entering their passcode before snatching the iPhone and running.

However it happens, once the thief has a user’s iPhone and passcode, they change the user’s Apple ID password—which is shockingly easy for them to do. With the new password,  they disable Find My, making it impossible for the iPhone’s owner to erase it remotely. Then they use Apple Pay to buy things and access passwords stored in iCloud Keychain. They can even look in Photos for pictures of documents containing confidential information, such as credit cards and ID cards. After that, they may transfer money from bank accounts, apply for an Apple Card, and more, all while keeping the user locked out of their account. Of course, they’ll resell the iPhone too. (Apparently, Android users are susceptible to similar attacks, but Android phones have a lower resale value, so they aren’t being targeted as much.) Victims have reported thefts of tens of thousands of dollars, and many of them remain unable to access their Apple accounts.

We fervently hope Apple addresses this vulnerability in iOS 17, if not before. At a minimum, Apple should require users to enter their current Apple ID password before allowing it to be changed, much as the company requires at the Apple ID website. Plus, Apple would ideally do more to protect access to iCloud Keychain passwords from a passcode-wielding iPhone thief. (The closest we have now is a different Screen Time passcode, which can prevent account changes, but it blocks access to so many settings that most people will find it too annoying and turn it off.)

Although the chances of you falling prey to one of these attacks is vanishingly low, particularly if you don’t frequent urban bars or areas that suffer from snatch-and-run thefts, the consequences of a passcode theft are so severe that it’s worth taking steps to deter the malicious use of your passcode. With luck, you’re already doing many of these things, but if not, take some time to re-evaluate your broader security assumptions and behavior.

Pay More Attention to Your iPhone’s Physical Security While in Public

Most importantly, you don’t want to make it easy for a thief to grab your iPhone. Apart from a wrist strap, there’s no reliable way to prevent someone from snatching it from your hand. When you’re not actively using your iPhone, stash it in a secure pocket or purse instead of leaving it out on a bar or table. Many people are blasé about protecting their iPhones, so if you take more precautions, you’re less likely to have problems.

Always Use Face ID or Touch ID When Unlocking Your iPhone in Public

The easiest thing you can do to protect yourself from opportunistic attacks is to rely solely on Face ID or Touch ID when using your iPhone in public. If a thief sees you entering a passcode, you could become a target.

We know people who avoid Face ID or Touch ID based on some misguided belief that Apple controls their biometric information, but nothing could be further from the truth. Your fingerprint or facial information is stored solely on the device in the Secure Enclave, which is much more secure than passcode entry in nearly all circumstances.

We’ve also run across people for whom Face ID or Touch ID works poorly—if that’s you, conceal your passcode from anyone watching, just as you would when entering your PIN at an ATM.

Use a Strong Passcode

By default, iPhone passcodes are six digits. You can downgrade that security to four digits, but don’t—that’s asking for trouble. You can also upgrade the security to an alphanumeric passcode that can be as long as you like, but that’s overkill, in our opinion. Video would still capture you entering it, and if you’re focused on entering it accurately, you’re less likely to be aware of someone shoulder-surfing behind you.

That said, make sure your passcode isn’t trivially simple. Basic patterns like 333333 and 123456 are far more easily observed or even guessed. There’s no reason not to use a passcode that’s memorable but unguessable, such as your high school graduating class combined with your best friend’s birth month.

Don’t Share Your Passcode Beyond Trusted Family Members

Even those who don’t have motivated thieves targeting them need to be careful to protect their passcode. Our simple rule of thumb is that if you wouldn’t give someone complete access to your bank account, you shouldn’t give them your passcode. If extreme circumstances require you to trust a person outside that circle temporarily, reset the passcode to something they’ll remember—even 111111—and change it back as soon as they return your iPhone.

Switch from iCloud Keychain to a Third-Party Password Manager

Although Apple keeps improving iCloud Keychain’s interface and capabilities, having all your Internet passwords accessible to a thief who has your iPhone and passcode is unacceptable. Instead, we suggest you use a third-party password manager like 1Password or BitWarden (we no longer recommend LastPass). Even when a third-party password manager allows easier unlocking with Face ID or Touch ID (which both 1Password and BitWarden do), they fall back on their master password, not the device’s passcode. After you move your passwords from iCloud Keychain to another password manager, be sure to delete everything from iCloud Keychain.

Delete Photos Containing Identification Numbers

Many people take photos of their important documents as a backup in case the original is lost. That’s a good idea, but storing photos of your driver’s license, passport, Social Security card, credit cards, insurance card, and more in Photos leaves them vulnerable to a thief who has your iPhone and your passcode. With the information in those cards, the thief has a much better chance of impersonating you when opening credit cards, accessing financial accounts, and more. Instead, store those card photos—or at least the information on them—in your password manager.

A Security Wakeup Call

Again, although it’s very unlikely that you would fall prey to one of these attacks, we appreciated the encouragement to re-evaluate our security assumptions and behaviors, and we suggest you do the same.

(Featured image by iStock.com/AntonioGuillem)

How to Share a Contact Card without Sharing Everything in iOS 16

Apple makes it easy to share contact cards on the iPhone or iPad—just scroll down in a contact and tap Share Contact. But what if you don’t want to share every piece of data on that card? To avoid oversharing in iOS 16 or iPadOS 16, tap Filter Fields at the top of the Share sheet and deselect the private items. If the card has a lot of data and you want to share only a few items, tap Deselect All Fields at the bottom of the sheet and select only what you want to share. Unfortunately, your selections aren’t remembered if you share the same card again later, so be sure to reset your selections each time you share.

(Featured image by iStock.com/diane39)

You Can Use Face ID in iOS 16 on Newer iPhones When You’re Lying on Your Side

If you’ve ever tried to use Face ID to unlock an iPhone while lying on your side in bed, you may have noticed that it didn’t work. That’s because Face ID used to require that the iPhone be upright, in portrait mode. In iOS 16, however, Apple has improved Face ID so it will unlock your iPhone even when you’re lying on your side and the iPhone is in landscape orientation. Alas, this capability requires an iPhone 13 or iPhone 14, but if you have one of those phones, give it a try in bed tonight—you don’t need to adjust any settings.

(Featured image by iStock.com/Kateryna Onyshchuk)

Use Quick Look to Preview Spotlight Results in Ventura

When you search using Spotlight on the Mac, it provides a decent amount of information about each result, including name and other metadata. But what if you want to see what’s behind the search result? In macOS 13 Ventura, Apple added Quick Look support to Spotlight so you can easily preview the search results. Do a search, click or use the arrow keys to select a search result, and then press the Space bar to open it in a Quick Look window. It even renders websites!

(Featured image based on an original by iStock.com/Nastco)