Questions tagged [phishing]

Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

Filter by
Sorted by
Tagged with
199 votes
3 answers
37k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
cja's user avatar
  • 1,629
171 votes
9 answers
245k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
Tobias Kienzler's user avatar
125 votes
5 answers
19k views

Why do phishing e-mails use faked e-mail addresses instead of the real one?

I read that you can write anything into the From: field of an e-mail. If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like [email protected] instead of ...
JFB's user avatar
  • 1,697
123 votes
5 answers
54k views

Why do phishing emails have spelling and grammar mistakes?

Are the spelling and grammar mistakes in phishing emails done on purpose? Is there some wisdom behind it? Or they are simply indicative of the fact that they've been written by someone who does not ...
Muhammad Hasan Khan's user avatar
88 votes
12 answers
16k views

When is phishing education going too far? [closed]

I currently work on the IT security team at my workplace in a senior role. Recently, I assisted management in designing the phishing / social engineering training campaigns, by which IT security will ...
Anthony's user avatar
  • 1,766
88 votes
9 answers
21k views

How to distinguish between a scam and a genuine call?

My bank called me the other day and the person who spoke to me failed to give me a single evidence that he is calling from my bank. The bank number is hidden just like many other companies maybe ...
Ulkoma's user avatar
  • 8,773
88 votes
1 answer
14k views

Isn't the BBC being extremely irresponsible in describing how to authenticate an account-related email?

On this webpage, the BBC says: I’ve received a ‘Changes to your BBC account’ email claiming to be from the BBC – is this a genuine email? At the end of September 2016, we upgraded our ‘BBC iD’ ...
Lightness Races in Orbit's user avatar
82 votes
8 answers
20k views

Risks of giving developers admin rights to their own PCs

I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
carolineggordon's user avatar
79 votes
8 answers
18k views

Company does not want any names on phishing reports

We have been recently contracted to run phishing tests for a company. Let's call it a company but basically they are obligated, by law, to assess the security of their environment with phishing ...
pm1391's user avatar
  • 1,437
77 votes
13 answers
19k views

Why is a link in an email more dangerous than a link from a web search?

Everyone knows of the common cybersecurity tips to be careful when you open links in an email. But every day we look for something on the Internet, clicking links which the search engine shows us, and ...
Adam Shakhabov's user avatar
74 votes
12 answers
19k views

Is there any definitive way to tell if an email is a phishing attempt?

Is there any definitive way to tell if an email is a phishing attempt? What cues should the "average computer" user employ to detect a phishing email?
daikin's user avatar
  • 1,069
68 votes
4 answers
111k views

Are there any security risks in replying to an SMS message?

I routinely receive seemingly harmless SMS messages from unknown people. They're usually simple, like "Hi" or "Hello" or "Are you there?". This happens several times a week, and certainly often enough ...
Caleb's user avatar
  • 659
60 votes
4 answers
9k views

What is the purpose of a targeted email without any meaningful content?

I received an email to my corporate email account from an external Gmail account. The list of recipients clearly shows (an eventually successful) attempt to guess my email address based on my personal ...
Itaypk's user avatar
  • 703
58 votes
4 answers
11k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
Stephen Touset's user avatar
54 votes
4 answers
10k views

Are non-English speakers better protected from (international) phishing?

After I received dozen of spam mails over the last year with my thrashmail (used for "You must log in once to check out this product.."-Sites, etc.) I noticed they were mostly translated (if they are ...
pguetschow's user avatar
52 votes
6 answers
11k views

Should a bank/financial service use external URL shortener services?

Say there is a bank/financial service that wants to have hyperlinks on their secure website/domain (or even in emails they send out to customers). In some of these links there are some long/obscure ...
hPNJ7MHTyg's user avatar
51 votes
5 answers
11k views

New Hires get phishing emails very quickly - Reasoning and how to stop

We hired a new Sales Ops member 1 week ago. Within a week he's getting emails similar to the below: I did some research on the sender and it is a valid email, valid person, SPF/DKIM checks come ...
Ryan Ternier's user avatar
47 votes
2 answers
16k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
supercobra's user avatar
45 votes
8 answers
37k views

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file? Clearly, HTML files may have malicious scripts embedded that could run when ...
Matthew's user avatar
  • 551
45 votes
4 answers
10k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from [email protected], with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
apertur's user avatar
  • 562
42 votes
2 answers
14k views

Why would PayPal send messages from another domain?

I have just received a message asking to consent to PayPal policy updates from the domain: https://epl.paypal-communication.com The actual link is full of trackers. Given the domain name, it sounds ...
antonio's user avatar
  • 835
41 votes
5 answers
6k views

Are there actions taken against websites that deliver malware?

There are serious tools and services such as Google Safe Browsing for malicious and phishing websites, and others fully dedicated to phishing websites such as Phishing.org. What is done against these ...
user avatar
37 votes
4 answers
6k views

What is the purpose of hiding spam links in some obscure forum posts?

I'm moderating one small Discourse forum and we, like everyone else, get spammers from time to time. Our forum is small, like 40-60 weekly unique visitors. Our forum requires that each new user's ...
Tommy's user avatar
  • 543
37 votes
2 answers
14k views

I have registered a .com domain and received an e-mail from domainadmin.com

I have registered a .com domain and received an e-mail from domainadmin.com, it looks extremely like a phishing e-mail, but after a research I am ultimately confused whether this thing is legitimate ...
redCodeAlert's user avatar
35 votes
6 answers
6k views

How to protect against SIM swap scammers?

SIM swap occurs where the scammer uses phished information about you to request a SIM card replacement from your cell phone carrier, by tricking them into believing that it is you who is making the ...
user610620's user avatar
35 votes
2 answers
2k views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
David Stratton's user avatar
31 votes
5 answers
4k views

Are address bars unphishable?

I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing: Ever wonder how good you are at telling the difference between a ...
badp's user avatar
  • 371
27 votes
3 answers
7k views

Another domain is using our web app's IP address. How to prevent it? [duplicate]

Our web application is being mimicked by another domain, https://www.djjpl.com.sg. On ping, it gives the same IP address as ours. Every git push to our server reflects on that domain. We want to stop ...
IamGhale's user avatar
  • 323
27 votes
4 answers
32k views

Is a safelinks.protection.outlook.com link phishing?

Received an email which contain the below hyperlink https://nam02.safelinks.protection.outlook.com/?url=http*3A*2F*2Factuallysale.com*2F&data=02*7C01*7C*7C548d20ace3ec4747fe1008d7d7d8b597*...
Daniel Kwan's user avatar
27 votes
3 answers
4k views

Why are developers using embedded user agents for 3rd party auth? What are the alternatives?

I've noticed a trend in mobile and desktop apps in recent years with the advent of OAuth (and it may also affect other frameworks) to request a user to sign up or log in using 3rd party authentication ...
pcdev's user avatar
  • 321
26 votes
5 answers
10k views

How could a scammer know the apps on my phone / iTunes account?

I received an email with the subject "Your invoice from Apple #xxxxx". It then continues by: "[...] your payment from "Pokemon Go was accepted [...]". That line made me sceptical. I just downloaded ...
Peter's user avatar
  • 363
26 votes
2 answers
1k views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
AKS's user avatar
  • 754
24 votes
6 answers
86k views

Is there a way to download a PHP file without it being executed?

I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the ...
Zaibis's user avatar
  • 711
24 votes
3 answers
4k views

Browser is accepting italic/bold Unicode as part of SPAM email's URL

This is truly crazy. I received a SPAM email in which there is a URL crafted from apparent Unicode characters that surprisingly exist for italic/bold letters, which when I reported it to Google's spam ...
asker13's user avatar
  • 351
24 votes
4 answers
1k views

Security seals and the "perception of safety"?

I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
Shurmajee's user avatar
  • 7,437
24 votes
4 answers
5k views

"Phishing" red flags and countermeasures

Given the recent spate of intrusions into various networks which have included compromise of subscriber identity and contact information, I figured it would be good for us to have a thread on how to ...
Iszi's user avatar
  • 27.1k
23 votes
2 answers
2k views

How can I trust that this is Google? [duplicate]

How do I trust that I am typing my password for Google when I'm using a Safari web view in an any iOS app?
bubakazouba's user avatar
22 votes
4 answers
9k views

Is this account change PDF email (supposedly from Paypal) an exploit?

i recently received the following (rather obvious) phishing email: i'm not a PayPal user so this particularly un-alarming for me. however, when viewing as plain text, it became evident that there ...
homerman's user avatar
  • 355
22 votes
5 answers
9k views

What is the best way to respond to phishing emails sent from a government domain?

In the past day or so, I've received two emails from different .gov addresses that purport to be from Intuit and encourage me to click on a link to "restore access to your QuickBooks account." They ...
gp782's user avatar
  • 323
22 votes
2 answers
2k views

A phone call hack

The other day, I got a call from a relative with an email problem. After a bit more discussion, it turns out that two days previously, a man phoned my relative: stated he was from microsoft; asked if ...
csgillespie's user avatar
  • 1,007
21 votes
5 answers
9k views

Apart from losing €40, is there any further risk if someone has my prepaid credit card number and home address? [closed]

My girl was scammed and entered my home address and my credit card number on a fake website (through a Facebook ad). What risks am I additionally incurring, apart from having lost €40 (the money that ...
CoffeDeveloper's user avatar
21 votes
4 answers
6k views

Redacting URLs as an email-phishing preventative?

In a large organization (e.g., a city staff), relying on human behavior to prevent phishing attacks isn't nearly effective enough. While it would be somewhat inconvenient (security usually is), I'm ...
Marc Rochkind's user avatar
20 votes
5 answers
6k views

Can a phishing website use the original (HTTPS, TLS) certificate? [duplicate]

If one has a phishing website that uses the original certificate that was obtained by accessing that website, can an attack fool users to believe they are accessing legitimate websites? If not, how ...
Kevin JJ's user avatar
  • 317
20 votes
3 answers
4k views

Is SiteKey a valid defense against Phishing?

As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. (This is a scheme where the user is shown a personalized image (each user has their own ...
David Stratton's user avatar
20 votes
2 answers
194k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
Matt McHenry's user avatar
20 votes
1 answer
2k views

How to verify Google sign-in screen is legit? (Linux Desktop) [duplicate]

I've installed an Electron app "Google Play Music Desktop Player" which presents a Google login screen: This is in a standalone window with no URL displayed. Although I have no reason not to trust ...
Andrew M.'s user avatar
  • 303
19 votes
4 answers
10k views

If someone bought the .local TLD could that be a security risk?

Now that the ICANN is allowing custom Top Level Domain names and often corporate IT workers like to use .local as the TLD for internal networks, if someone does buy the .local TLD what are some ...
Scott Chamberlain's user avatar
19 votes
3 answers
3k views

Should I visit a website of a popular company if the browser warns of a potential security risk?

I have faced this situation several times. Some websites are presented as a potential security risk. Should I continue to browse such a webpage? I am attaching one example, just an example. Actually I ...
paki eng's user avatar
  • 291
16 votes
4 answers
11k views

Is it a good security practice to force employees hide their employer to avoid being targeted?

A young tech company which operates on sensitive data has employees that fall victim to phishing/porting scams despite its best efforts to instill security fobs, vpn, password managers, non-sms 2FA, ...
Josh Hibschman's user avatar
16 votes
1 answer
4k views

Why doesn't Gmail make it clearer that emails have been signed by DKIM and delivered over TLS?

If a webpage is delivered over HTTPS, the browser makes this clear with a padlock symbol. It's something that people look for. My browser also makes it clear that a page is not secure. Why aren't ...
Ian Warburton's user avatar

1
2 3 4 5
12