Brasenose College IT

A phishing email is an unsolicited email that tries to collect information about you, which could then be used to enter your accounts without permission.  This article will explain how to recognise and deal with phishing emails.

It is important to remember that if at any time you feel you may have been compromised, the IT office are here to help. Contact them as soon as possible for help before the threat affects you/others more seriously.

The easiest way to steer clear of scam emails is to never click on any link in an unsolicited email. If the email asks you to do something, log into your account via the official website of the company who has contacted you rather than following the links.

Phishing e-mails vary from the obvious – those with complete lack of grammar – to the fairly sophisticated. Your junk filter will remove most of the really obvious ones, but will be less efficient at detecting more sophisticated scams. Before clicking on any links in an e-mail you’ve received, there are a few simple things you can check:

1.  Repeated occurrencces of bad punctuation and grammar, and/or unnecessary capitalisation

This is normally a red flag; official e-mails are unlikely to contain such errors.

2. Unrelated sender address

This can be an easy give-away. If a seemingly legitimate e-mail from PayPal (for example) has the sender address  <l_paschek@profthome.de>, or some other generic/strange address, it’s normally safe to assume it’s not legitimate. 

3. Generic salutations

Often scam e-mails will begin with a phrase such as ‘Dear Customer’ or ‘Dear User’. While not a guarantee that the e-mail is illegitimate (and the converse: not necessarily legitimate if you are addressed personally) it is another warning sign that you can look for.

4. The e-mail contains threats or ‘warnings’ of account deletion or deactivation, loss of data, loss of services, etc; and asks you to log in or verify your details, either in the e-mail or via a link provided in the e-mail.

These e-mails tend to use tactics such as telling you that you’ve reached your limit on your mailbox or that you have an overdue bill, etc. They then tell you to log in, or verify your details in some way. The blatant scams ask you to send the details in an e-mail reply. No legitimate company will ever ask you to do this as it is completely unsecure. More sophisticated attempts will ask you to log in via a link and enter your details there.

5. The links don’t go where they’re supposed to

The easiest way to check if an e-mail is legitimate is to hover over the links it provides. It’s very easy to make it look like a link is going to one place while in fact it is going somewhere completely unrelated. You should check this by hovering your mouse over the link and checking the link in the roll-over text. As with the sending address, remember to check for subtle replacements of similar characters (1 for l, and so forth).

If you are still in doubt, or worried about the contents of the email, do not click the links in it. Instead, navigate to the official website of the company claiming to have e-mailed you, using your browser of choice.

Unsolicited e-mails may sometimes contain a link to unsubscribe from their mailing list. You should be careful to only ever click this link if you can remember subscribing in the first place, as clicking on an illegitimate unsubscribe link will inform malicious parties that your e-mail address is active, and your address may be passed on to more spammers, leading to an increase in junk mail. Rather than unsubscribing from e-mail lists you don’t recognise, it’s best to add their address to your list of blocked senders.