Fraud Cleanup

A Phishing Scam Example, Taken Apart Piece by Piece

One fake email, labeled part by part. Learn the tells and you can read any phishing message.

Why one example teaches you to spot them all

A phishing scam example is worth more than a list of warnings. Once you read one fake message closely, you can read them all. The FTC says scammers use email or text messages to trick you into giving them your personal and financial information. The FBI says these emails are designed to get your personally identifiable information or financial credentials. The tricks repeat. Here is one message, taken apart.

The example: a fake "suspicious activity" email, built from the signs the FTC lists

Here is a made-up message built from the signs the FTC lists, so you can see how they fit together:

Subject: Suspicious activity on your account

Dear Customer,

We noticed suspicious activity or log-in attempts on your account. Your account is on hold because of a billing problem. Click the link below to update your payment details and restore access.

[Update Payment Details]

Attachment: Account_Notice.pdf

Every part of that message is a scam tell. The story is urgent. The link goes somewhere you should not go. The attachment is bait. And the whole point is to get you to hand over payment details.

The story the email tells

The FTC says phishing emails and text messages often tell a story to trick you into clicking on a link or opening an attachment. The FTC lists several stories these messages tell:

  • Suspicious activity. The FTC says a phishing scammer might say they noticed suspicious activity or log-in attempts when they have not.
  • An account problem. The FTC says a phishing scammer might claim there is a problem with your account or your payment information when there is not.
  • A request to confirm information. The FTC says a phishing scammer might say you need to confirm some personal or financial information when you do not.
  • A fake invoice. The FTC says a phishing scammer might include an invoice you do not recognize, and it is fake.
  • A payment link. The FTC says a phishing scammer might want you to click on a link to make a payment, but the link has malware.

The FTC lists other stories too. A phishing scammer might say you are eligible to register for a government refund, and it is a scam. Another might offer a coupon for free stuff, and it is not real.

The tells that give it away

Some signs are small. The FBI says scammers use slight differences in email addresses, URLs, and spelling to trick your eye and gain your trust. PayPal's own security page says typos, misspellings, and incorrect grammar are common in phishing messages. So read the sender address slowly, letter by letter.

Other signs look like proof but prove nothing. The FTC says a scam email may use a company's real logo in the header and still be fake. Anyone can copy a logo.

The padlock and the "https" in a web address do not clear the message either. PayPal's page says the letter s in https does not always mean a site is legitimate, because hackers can build encrypted sites too. It also says many fake sites show a padlock symbol in the address bar, so you should not rely on it. The FBI says fake websites used in phishing are made solely to steal your information.

What the scammer is after

The FTC says scammers use email or text messages to try to steal your passwords, account numbers, or Social Security numbers. The FTC says scammers who get your information could get access to your email, bank, or other accounts. It also says they could sell your information to other scammers. And the FTC says phishing emails can lead to identity theft for people who give scammers their information.

The same scam by text and phone

Phishing does not stay in your inbox. The FBI says smishing uses SMS text messages instead of email. The FBI says vishing uses phone calls, generally with an automated voice. The hooks are the same. Only the delivery changes.

The caller ID proves nothing on a phone call. PayPal's page says scammers can easily fake a Caller ID, so a call that says PayPal is not necessarily from PayPal. It also says you should not call back a number an automated call gives you.

What to do when you spot one

The FTC says if you see signs of a phishing scam, report the message and then delete it. Do not just close it and leave it sitting in your inbox.

Where to report it depends on what you got:

  • The FTC's advice says that if you got a phishing email, you should forward it to the Anti-Phishing Working Group at reportphishing@apwg.org.
  • The FTC's advice says that if you got a phishing text message, you should forward it to SPAM (7726).
  • The FTC's advice says to report the phishing attempt to the FTC at ReportFraud.ftc.gov.
  • The FBI says to report spoofing and phishing to its Internet Crime Complaint Center at ic3.gov.

The FTC's advice says attachments and links might install harmful malware. The FBI says not to click on anything in an unsolicited email or text message.

If you clicked a link before you caught on, do not trust a phone number inside the message. The FBI says to look up a company's phone number on your own and call the company to ask if a request is legitimate. The FBI also says companies generally do not contact you to ask for your username or password. A request for either one is a bad sign on its own.

Make yourself a harder target

The FTC suggests these steps to protect yourself:

  • Ask yourself if you know them. The FTC says to ask yourself whether you have an account with the company or know the person who contacted you. If the answer is no, it could be a phishing scam.
  • Use multi-factor authentication. The FTC says to protect your accounts by using multi-factor authentication. It makes it harder for scammers to log in to your accounts if they do get your username and password.
  • Keep your software updated. The FTC says to protect your computer with security software set to update automatically. It also says to protect your cell phone by setting its software to update automatically.
  • Let spam filters work. The FTC says your email spam filters might keep many phishing emails out of your inbox. But it also says scammers are always trying to outsmart spam filters, so extra layers of protection can help.

Want more detail? See how a phishing scam works from the scammer's side. Or dig deeper into phishing in general. If the fake message claims to be from a payment company, our page on the PayPal email scam walks through that version.

PayPal's page says real PayPal messages always use the full name listed in your PayPal account. It also says attachments can contain malware, so you should never open them unless you are completely sure they are legitimate.

Sources