186 votes
Accepted

Why do phishing e-mails use faked e-mail addresses instead of the real one?

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF),...
Steffen Ullrich's user avatar
152 votes
Accepted

Company does not want any names on phishing reports

This initial campaign established a baseline first. So, yes, it's normal. "How do we as a company stand? To what level do we need to train? Do we have, as a whole, secure users or do we have, as a ...
baldPrussian's user avatar
  • 2,778
128 votes

Company does not want any names on phishing reports

No, because by giving names you are assigning blame, security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web ...
McMatty's user avatar
  • 3,270
102 votes

When is phishing education going too far?

I think there is an underlying problem that you will need to address. Why do the users care that they are failing? Phishing simulations should, first and foremost, be an education tool not a testing ...
schroeder's user avatar
  • 129k
102 votes
Accepted

Why is a link in an email more dangerous than a link from a web search?

The results of a search engine are based on previously collected data, i.e. the engine does not starts to scanning the whole internet when doing a search but it looks through an index of seen and ...
Steffen Ullrich's user avatar
98 votes
Accepted

What is the purpose of a targeted email without any meaningful content?

Attempting to send a message to a non-existant email address will typically result in a “bounceback” message with an error code like 510 or 550 invalid address. If you try several addresses and there ...
Relaxed's user avatar
  • 1,739
96 votes

Is there any definitive way to tell if an email is a phishing attempt?

There are a number of both technical and non-technical ways that someone can identify a phishing attempt. Communicate out of Band. The easiest reliable way is to communicate with the proposed sender ...
DKNUCKLES's user avatar
  • 9,237
86 votes

Why is a link in an email more dangerous than a link from a web search?

Let me use an analogy: It's for the same reason we tell our children not to take sweets from strangers, but at the same time we allow them to buy some in the supermarket with their pocket money. Or ...
Marcel's user avatar
  • 4,086
85 votes
Accepted

Is this account change PDF email (supposedly from Paypal) an exploit?

This is just regular malware spam. The evil part of this message is likely the attached PDF it mentions. It likely contains an exploit which targets a vulnerability in one or more PDF readers and ...
Philipp's user avatar
  • 49.4k
84 votes
Accepted

New Hires get phishing emails very quickly - Reasoning and how to stop

Presumably, your MX record is suffering from a directory harvest attack (DHA). There are lots of ways to do this and unless you're very savvy at pouring through your mail logs, most of them are (by ...
Adam Katz's user avatar
  • 11.2k
78 votes
Accepted

How could a scammer know the apps on my phone / iTunes account?

It's a game of probability and chances are high that you might have one of the most popular apps in history installed on your device. My guess is that the scammer does not know anything about you. ...
SeeYouInDisneyland's user avatar
76 votes
Accepted

Are non-English speakers better protected from (international) phishing?

There is a really, really good paper on this here. Tl;dr: 95% of spam is in English In f.ex. Germany only 17% of the spam is in German In Scandinavia it's less than 1% in the local language ...
AdHominem's user avatar
  • 3,036
76 votes

Are there any security risks in replying to an SMS message?

Some telephone or SMS numbers allow for an additional charge that is automatically recovered by your phone provider and reversed to the owner of the number. This is mainly used (legally) for some TV ...
Serge Ballesta's user avatar
59 votes

When is phishing education going too far?

We have been getting push back from end users that they have no way of distinguishing a legitimate email that they would receive day to day from truly malicious phishing emails. This is an indication ...
Blrfl's user avatar
  • 1,618
58 votes

Redacting URLs as an email-phishing preventative?

First of all, it would be a usability nightmare. Second, it wouldn't even fix the problem it purports to. While it could be effective to phishing mails designed for 'normal' clients, attacks designed ...
Ángel's user avatar
  • 18.8k
57 votes
Accepted

Another domain is using our web app's IP address. How to prevent it?

Our web application is being mimicked by another domain ... The domain in question is configured to resolve to the same IP address as yours. That's why it looks like they mimic you when in fact it is ...
Steffen Ullrich's user avatar
55 votes
Accepted

What is the purpose of hiding spam links in some obscure forum posts?

It could be an attempt to boost the spam sites in search engine results by creating backlinks to it, which is a common SEO technique (although debatable how effective it is, as search engines can ...
Gh0stFish's user avatar
  • 10.1k
50 votes

How to protect against SIM swap scammers?

You don't use SMS for a second factor. SMS is not secure by any means. The text is on clear, the traffic is on clear, and it's trivially easy to get a new SIM by pretending to be the victim. I once ...
ThoriumBR's user avatar
  • 53.9k
49 votes

Company does not want any names on phishing reports

I think the correct angle to look at this, is to ask the following question: With the amount of people that failed the test, what (security) goals would be accomplished if the company had these names?...
Tom K.'s user avatar
  • 7,975
48 votes

Apart from losing €40, is there any further risk if someone has my prepaid credit card number and home address?

Call the credit card company! They have procedures for this including blocking your credit card and replacing it. You might even be able to get the 40€ back. There is a lot of articles about this ...
Jester's user avatar
  • 663
47 votes
Accepted

What is the best way to respond to phishing emails sent from a government domain?

It is likely that the from header has been forged. I get emails from fake .govs quite often, mostly they end up in my spam filter. The hyperlink within is either unique, allowing tracking, or just ...
AstroDan's user avatar
  • 2,238
45 votes

Browser is accepting italic/bold Unicode as part of SPAM email's URL

Previous answers both tell part of the story here, but there's a few different aspects to understand. Firstly, why do these code points exist? Unicode has the ambition to replace all previous ways of ...
IMSoP's user avatar
  • 3,860
40 votes

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

Editors, and common libraries used by editors, may have vulnerabilities like buffer overflows. Your attacker would need to know (or guess) what editor you use and craft an exploit specifically for ...
Thomas's user avatar
  • 509
39 votes
Accepted

Why doesn't Gmail make it clearer that emails have been signed by DKIM and delivered over TLS?

TL;DR: Mail delivery using TLS and signing using DKIM are weak protections, compared to accessing a web site using HTTPS. They should not be assumed to provide the same security and the indicators ...
Steffen Ullrich's user avatar
37 votes
Accepted

Is it illegal to DDoS a phishing page?

If you do a DDoS by sending large amounts of traffic to that site, you're very likely creating a lot of collateral damage since other services in (parts of) the network will suffer as well if the ...
Teun Vink's user avatar
  • 6,918
36 votes

When is phishing education going too far?

There's one possible point to make that I haven't seen in other answers, but have seen in the real world. Users say they "have no way of distinguishing a legitimate email that they would receive day ...
James_pic's user avatar
  • 2,580
35 votes
Accepted

How can I trust that this is Google?

How do I trust that I am typing my password for google You do not. Apps should allow you to do that through actual Safari browser in another window, where you can see the address bar.
Greendrake's user avatar
35 votes

Should I visit a website of a popular company if the browser warns of a potential security risk?

As a practical matter, in this particular case you're probably fine. Certificates have expiration dates for a number of reasons, one of which is that there's always some risk of compromise (leaking ...
CBHacking's user avatar
  • 47.6k

Only top scored, non community-wiki answers of a minimum length are eligible