Hazards of email
We tend to be much less cautious about emails , especially if the "from" address is a person or company we already know..
So the first lesson is - you cant believe the "from" address. A very simple process called "email spoofing" allows a criminal -or comedian - to forge the "sender" address and send you an email that LOOKS as if it comes from "Lloyds Bank" - or "Microsoft" - or "HMRC" - or ANYONE else. Even one of your friends.
How did the criminals get my email address?
There are many ways this may have happened. Here are a few:
- A data breach: Very sophisticated hackers - often supported by hostile countries - target online organisations, often with the aim of accessing their data. Any personal information gathered - your name, email address, account number, etc will then be sold on the "dark web".
- From the web or social media: A "spambot" roams the web gathering any email addresses it finds, and "reporting them back" to the hackers. Again to make lists for sale. Every time you use your email address to log in or "register" on a site your email address may be exposed.
- Using a virus: Email viruses often spread by causing the malicious message to be sent to everyone in the original victim's address book.
- Phishing: You may have been tricked into giving them your email address.
What harm can it do if they have information about me?
The main problem is including this information makes an email more credible. Suppose by "phishing" or a data breach they have discovered your broadband provider is talktalk - and they have your account number. (yes this HAS happened). They may also use information they can reasonably suppose - such as your bank, mobile or broadband provider, or that you are expecting a delivery.
Example email from "Primark.co.uk"
To expand our customer base we are giving away £5 gift cards to new customers. To receive your card please complete the attached form giving your name and full address and click the "Send" button. You will receive your gift card by post within 14 working days.
So to "get your card" you need to: open an attachment (could be a virus); enter your personal information (to add to their list); and click a button (that could do anything)
Example email from "talktalk"
Dear Jenny; we are sorry to inform you that there has been a problem with your account (last three digits of account number) which may have resulted in a loss of service. In line with our general conditions you are eligible for a refund. To claim your refund please follow this link to your account page, and confirm the details are correct. ...
Can you see how the inclusion of some information they have already can make the email more believable? Of course the "account page" would be a fake.
Social engineering
Spam emails use "social engineering" to entice - or worry - you into being less suspicious of the content of a spam email. The examples above use greed as an incentive - more insidious scams use fear.
The top email scam types currently include:
- A government office payment eg overpaid tax, driving licence expiry etc
- Order Confirmation or Cancellation Scams – a fake Amazon order and offer to cancel it
- Online payment scam - PayPal, Google Pay etc.
- Delivery Scam – is there a parcel waiting for you?
- Sextortion Scam – the threat of leaking private information
- Account Recovery Scam – the danger of locking you out of your Microsoft, broadband provider or Apple account
- Bank Phishing – an authentic looking financial email
- Investment Scams – tempting offers to invest your money
- Facebook Activity Alerts – imitating genuine Facebook notifications
- Google and Gmail Alert Scams – attempts to get your login details
All of the above scams attempt to trick victims in a similar fashion. You're encouraged to click through a link, at which point, victims can inadvertently hand over sensitive data to scammers.
Example from REAL scam email
Links - especially in emails - can take you to an information harvesting page that aims to steal your identity. Here is an example copied from a real scam email, but made safe, and with corporate graphics removed (so I don't get prosecuted by AMAZON). The email claimed a payment had been refused.
Click to see it.