Infographic: Steps to Avoiding Forged Email
Forged emails are extremely common. Most of the time forged emails are merely a nuisance.However, if you accidentally share information with or click on a link from someone who sent a forged email, the results can devastate your goal or even your site, or if it’s really evil, an entire computer. Here’s some information about how to recognize and stop forged emails.
How to Avoid Forged Email: Forged Email Facts & SPF Significance
Share This Infographic On Your Site
What is a forged email?
Forged email or “email spoofing” is when an email appears to be legitimate but an untrustworthy source sent it. A forged email may look as if it’s from someone you know, like a friend or coworker. It might also seem to come from a company or business that you trust, like Amazon or your local bank. Forgers can even spoof your own email address and send emails posing as you.
The goal of email spoofing or email forgery is to entice you to open a phony email, click a link, download an attachment (which might contain a virus), or share personal information, like passwords or credit card info.
Note: The act of trying to acquire personal info, such as passwords or credit card info in an unauthorized way is called phishing.
Statistics:
- Unreliable sources send more than 150 million phishing emails daily around the world.
- Of those 150 million emails, 16 million make it past email filters.
- People open 8 million of those 16 million emails, and some click 800,000 links.
- Every day, phishing tricks roughly 80,000 people and shares valuable or personal information.
- According to a 2014 Microsoft Computing Safer Index Report, phishing scams around the world cost roughly $5 billion.
Most companies and email networks use SPF (Sender Policy Framework), DKIM (Domain Keys Identified Email), and DMARC (Domain-based Authentication, Reporting and Conformance) to help validate their senders and sending servers so that recipients can identify and discard forged email. As of 2013, most consumer mailboxes around the world (60 percent) use DMARC. However, BitSight, a security ranking vendor, conducted a study that revealed the following: Of the top S&P 500 companies, only 24 percent have a strong SPF in place.
How do you prevent forged email from occurring?
Email forgers typically go for volume over quality. They forge or spoof large amounts of email to trick the most people into sharing personal info. Here are a few things to look for to recognize a suspicious email message:
Overly urgent language
Does the email’s wording seem off? Rushed? Or does the email’s tone seem overly urgent and somewhat, but vaguely, threatening? For example, “Please pay your bill now or there will be consequences!”
Greeting
Most fake emails use general greetings, such as “Dear loyal customer” or “Dear Member.” If the message doesn’t include your name, or if there’s some indication that the email’s writer doesn’t know you in some way, then move the email into the spam folder immediately and delete.
Dead giveaways
Odd punctuation and strange usage of capital letters (e.g. you MUST pay now!!!) are dead giveaways of email forgery. If the email doesn’t look quite right, say, for example, the business’ header in the email seems pixelated or off, or if the email’s format is drastically different from most of that business’ previous emails, then it’s probably forged.
URLs or strange “from” email addresses
If you receive an email from “Amazon,” but the email address doesn’t match correctly or seems off in some way, then the email is probably forged. Also, if the email requests that you click a link for an Amazon or other legitimate page, but the URL leads to a different site, beware.
If you receive an email from yourself that you didn’t send.
This is a telltale sign of email forgery.
How to stop forgery
- Never trust email as authorization of any significant action or activity. If the email prompts you to transfer money or change an access level, call the sender (who you believe is the sender) and verify the email’s validity. Spearphishers can make targeted, forged email messages that are impossible for a lay person to distinguish from legitimate email messages.
- Use a premium email filtering system that includes SPF and DKIM checking. This type of filtering should help to stop spam and forged emails.
- Enable SPF, DKIM on all your own domains.
- Turn off catch-all email aliases.
- Remove your own email addresses and domain names from your Allow Lists.
- If you have any doubts about an email, don’t click any included links.
- Take your time when reading emails: it’s easy to quickly skim an email and click a link without thinking.
- Use different passwords for each site you visit and use a good password manager to keep them all straight. If one site is compromised, that shouldn’t compromise your other accounts.
Sources
- https://luxsci.com/blog/stopping-forged-email-1-spf-rescue.html
- https://luxsci.com/blog/analyzing-forged-email-message.html
- https://luxsci.com/blog/stopping-forged-email-4-last-resorts.html
- http://www.pcmag.com/encyclopedia/term/42249/e-mail-spoofing
- http://searchsecurity.techtarget.com/definition/email-spoofing
- http://www.lavasoft.com/mylavasoft/company/blog/the-big-three-email-nuisances-spam-phishing-and-spoofing
- http://wivb.com/2014/07/21/email-spoofing-it-is-no-laughing-matter/
- http://www.forbes.com/sites/benkepes/2014/03/04/security-statistics-show-that-we-need-to-reinvent-enterprise-it/
- http://www.auburn.edu/oit/phishing/
- http://www.windowsecurity.com/whitepapers/misc/How_to_protect_from_SpoofedForged_Email_.html
