187 votes
Accepted

Why do phishing e-mails use faked e-mail addresses instead of the real one?

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF),...
user avatar
183 votes
Accepted

Why do phishing emails have spelling and grammar mistakes?

This may well be for the same reason as many scammers rely on the tired old 'Nigerian Prince' strategy: by self-selecting for gullible targets, they can be more efficient. In phishing, as in scams, ...
user avatar
  • 1,850
153 votes
Accepted

Company does not want any names on phishing reports

This initial campaign established a baseline first. So, yes, it's normal. "How do we as a company stand? To what level do we need to train? Do we have, as a whole, secure users or do we have, as a ...
user avatar
  • 2,758
128 votes

Company does not want any names on phishing reports

No, because by giving names you are assigning blame, security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web ...
user avatar
  • 3,182
119 votes
Accepted

How to distinguish between a scam and a genuine call?

If you're worried about the authenticity of a cold-call, don't try over-the-phone authentication in either direction. Simply ask for some basic information you can use to refer to the issue in follow-...
user avatar
  • 27k
102 votes

When is phishing education going too far?

I think there is an underlying problem that you will need to address. Why do the users care that they are failing? Phishing simulations should, first and foremost, be an education tool not a testing ...
user avatar
  • 123k
102 votes
Accepted

Why is a link in an email more dangerous than a link from a web search?

The results of a search engine are based on previously collected data, i.e. the engine does not starts to scanning the whole internet when doing a search but it looks through an index of seen and ...
user avatar
97 votes

Is there any definitive way to tell if an email is a phishing attempt?

There are a number of both technical and non-technical ways that someone can identify a phishing attempt. Communicate out of Band. The easiest reliable way is to communicate with the proposed sender ...
user avatar
  • 9,207
94 votes
Accepted

What is the purpose of a targeted email without any meaningful content?

Attempting to send a message to a non-existant email address will typically result in a “bounceback” message with an error code like 510 or 550 invalid address. If you try several addresses and there ...
user avatar
  • 1,680
92 votes
Accepted

Isn't the BBC being extremely irresponsible in describing how to authenticate an account-related email?

Very dangerous things could happen here, indeed. It would be laughably easy for a scammer to phish users. A migration is an excuse many phishers already use: There was xyz problem in our user ...
user avatar
87 votes
Accepted

Is this account change PDF email (supposedly from Paypal) an exploit?

This is just regular malware spam. The evil part of this message is likely the attached PDF it mentions. It likely contains an exploit which targets a vulnerability in one or more PDF readers and ...
user avatar
  • 48.8k
86 votes

Why is a link in an email more dangerous than a link from a web search?

Let me use an analogy: It's for the same reason we tell our children not to take sweets from strangers, but at the same time we allow them to buy some in the supermarket with their pocket money. Or ...
user avatar
  • 3,512
85 votes
Accepted

New Hires get phishing emails very quickly - Reasoning and how to stop

Presumably, your MX record is suffering from a directory harvest attack (DHA). There are lots of ways to do this and unless you're very savvy at pouring through your mail logs, most of them are (by ...
user avatar
  • 9,101
78 votes

Are there any security risks in replying to an SMS message?

Some telephone or SMS numbers allow for an additional charge that is automatically recovered by your phone provider and reversed to the owner of the number. This is mainly used (legally) for some TV ...
user avatar
78 votes
Accepted

How could a scammer know the apps on my phone / iTunes account?

It's a game of probability and chances are high that you might have one of the most popular apps in history installed on your device. My guess is that the scammer does not know anything about you. ...
user avatar
76 votes
Accepted

Are non-English speakers better protected from (international) phishing?

There is a really, really good paper on this here. Tl;dr: 95% of spam is in English In f.ex. Germany only 17% of the spam is in German In Scandinavia it's less than 1% in the local language ...
user avatar
  • 3,006
69 votes
Accepted

Is there a way to download a PHP file without it being executed?

If the server is configured correctly, you cannot download a PHP file. It will be executed when called via the webserver. The only way to see what it does is to gain access to the server via SSH or ...
user avatar
  • 7,349
62 votes
Accepted

Are there actions taken against websites that deliver malware?

Okay, personal anecdote time. I'm a sysadmin in real life, working for an ISP that primarily caters to small to medium businesses. One of our larger customers operates, among other things, an ...
user avatar
  • 2,485
59 votes
Accepted

Another domain is using our web app's IP address. How to prevent it?

Our web application is being mimicked by another domain ... The domain in question is configured to resolve to the same IP address as yours. That's why it looks like they mimic you when in fact it is ...
user avatar
59 votes

When is phishing education going too far?

We have been getting push back from end users that they have no way of distinguishing a legitimate email that they would receive day to day from truly malicious phishing emails. This is an indication ...
user avatar
  • 1,628
59 votes

Redacting URLs as an email-phishing preventative?

First of all, it would be a usability nightmare. Second, it wouldn't even fix the problem it purports to. While it could be effective to phishing mails designed for 'normal' clients, attacks designed ...
user avatar
  • 17.4k
57 votes
Accepted

Paypal sent an email addressing me with one of my old passwords as my name

It seems like the spammer got your personal information including your password through a security breach somewhere. Why did they use your password instead of your name? I would say it was an honest ...
user avatar
  • 48.8k
50 votes

Why do phishing emails have spelling and grammar mistakes?

Emails with mistakes are probably from people who don't know English well enough to write it correctly. Many phishing emails do not have mistakes and may be copied directly from emails sent by the ...
user avatar
  • 2,247
50 votes

How to protect against SIM swap scammers?

You don't use SMS for a second factor. SMS is not secure by any means. The text is on clear, the traffic is on clear, and it's trivially easy to get a new SIM by pretending to be the victim. I once ...
user avatar
  • 50.5k
49 votes

Company does not want any names on phishing reports

I think the correct angle to look at this, is to ask the following question: With the amount of people that failed the test, what (security) goals would be accomplished if the company had these names?...
user avatar
  • 7,913
48 votes
Accepted

What is the best way to respond to phishing emails sent from a government domain?

It is likely that the from header has been forged. I get emails from fake .govs quite often, mostly they end up in my spam filter. The hyperlink within is either unique, allowing tracking, or just ...
user avatar
  • 2,226
48 votes

Apart from losing €40, is there any further risk if someone has my prepaid credit card number and home address?

Call the credit card company! They have procedures for this including blocking your credit card and replacing it. You might even be able to get the 40€ back. There is a lot of articles about this ...
user avatar
  • 663
46 votes

Browser is accepting italic/bold Unicode as part of SPAM email's URL

Previous answers both tell part of the story here, but there's a few different aspects to understand. Firstly, why do these code points exist? Unicode has the ambition to replace all previous ways of ...
user avatar
  • 3,772
42 votes
Accepted

I have registered a .com domain and received an e-mail from domainadmin.com

As Polynomial mentioned, this is part of ICANN-mandated WHOIS verification. The reason it goes to domainadmin.com is that ICANN doesn't actually run the verification -- rather, like just about all ...
user avatar
  • 7,133

Only top scored, non community-wiki answers of a minimum length are eligible