By the end of this lesson you will be able to
- Tell the difference between spam, phishing and a genuine message.
- Point out at least five warning signs in a simulated phishing email.
- Respond safely to a suspicious message: do not click, do not reply, report and delete.
- Set up recovery options and protect an email account with a strong passphrase and multifactor authentication.
Your email account is the master key to your online life. Almost every other account, from your bank to your social media, can send a password reset link to your email. Whoever controls your email can often take over the rest. Criminals know this, so they send huge numbers of fake messages hoping that a few people will click. You do not need to be a technical expert to defeat them. You need a calm habit of checking a few clues before you act, and a well-protected account.
Spam and phishing: two different problems
Spam is unwanted email sent in bulk, usually advertising. It is annoying but often harmless if you simply ignore or delete it. Phishing is more dangerous. It is a message designed to trick you into giving away a password, money or personal details, or into opening something harmful. It pretends to come from someone you trust, such as a bank, a delivery company, your employer or a friend. Phishing is a form of social engineering: it attacks the person, not the computer.
| Spam | Phishing | |
|---|---|---|
| Aim | Sell something or fill your inbox | Steal a password, money or data, or install malware |
| Typical message | A discount offer or a pill advert | Your account is locked, click here to confirm |
| Danger if you ignore it | Almost none | None, if you really ignore it |
| Danger if you click or reply | Confirms that your address is live, so you get more | You may lose your account, money or identity |
| Best response | Mark as junk and delete | Do not click, report, delete |
A third kind of message deserves a mention. Spoofing means faking the sender, so that the name or address looks like a person or company you trust. Both spam and phishing often use it. The name shown at the top of a message is only a label that the sender chooses. The real address behind it is what counts.
Warning signs in a suspicious message
Phishing messages are written to make you act before you think. They create urgency (your account will be closed in 24 hours), fear (suspicious activity), greed (you have won a prize) or curiosity (a parcel is waiting). The figure below is an educational simulation of a phishing email from an entirely fictional bank. Study the numbered clues, then look at the list that follows.
From: Riverbank Security <support@riverbank-secure-login.example>
Subject: Urgent: your account will be closed
Dear customer,
We noticed unusual activity on your acount. Confirm your details within 24 hours or your account will be closed for securty reasons.
Link goes to: http://riverbank-verify.example.net/login
- Marker 1: Sender address is not the bank's own domain
- Marker 2: Generic greeting, no real name
- Marker 3: Threat and a short deadline
- Marker 4: Spelling mistakes: acount, securty
- Marker 5: Button leads to a different, unrelated site
Read this figure as text
A simulated email message from a fictional bank with numbered warning signs on the sender, greeting, urgency, link and button.
Educational simulation with a fictional bank, not a real company. The sender name reads Riverbank Security but the address is support@riverbank-secure-login.example. The subject is Urgent: your account will be closed. The greeting is Dear customer, not your name. The text says: We noticed unusual activity. Confirm your details within 24 hours or your account will be closed. A button reads Confirm now, and the real destination of the link, shown by hovering, is http://riverbank-verify.example.net/login. The text also has two spelling mistakes: acount and securty. Marker 1 points to the sender address, which does not belong to the bank's real domain. Marker 2 points to the generic greeting. Marker 3 points to the urgent threat and deadline. Marker 4 points to the spelling mistakes. Marker 5 points to the button, whose real destination is a different domain.
- The sender's address does not match the organisation. Real banks use their own domain. Look at the part after the @ and compare it with an address you already trust.
- A generic greeting such as Dear customer. Organisations that hold your account usually know your name.
- Urgency or a threat. Real organisations rarely close an account within a day without other warning.
- Spelling and grammar mistakes. Not every phishing message has them, and a perfect message is not proof of honesty.
- A link or button whose real destination is different. On a computer, hover the pointer over a link without clicking and the true address appears at the bottom of the window. On a phone, press and hold may show it.
- Requests for passwords, codes, card numbers or payment. A genuine organisation does not ask for your password by email.
- Unexpected attachments, especially zip files, or a request to enable macros.
https://Schemesecure, but not proof of honestyriverbank.login.Subdomainchosen freely by the ownerverify-now.exampleDomainthe real owner/confirmPageafter the first slashRead this figure as text
A web address broken into parts to show which part names the real owner of a fake link.
The fictional address https://riverbank.login.verify-now.example/confirm is split into parts. https:// is the scheme. riverbank.login is a subdomain, chosen freely by the owner of the domain and therefore not proof of anything. verify-now.example is the domain, which is the real owner. /confirm is the page. The bank name appears in the subdomain only; the real owner is verify-now.example, which is not the bank.
All messages in this lab are educational simulations with fictional people and companies. Inspect each one, decide whether it is safe or phishing and read the reasons.
Loading lab…
What to do with a suspicious message
A calm routine for any suspicious message
Step 1: Stop and do not click
Do not open attachments, press buttons, scan codes or call numbers inside the message. Urgency is a tactic, so give yourself time.
You should see: The message is on your screen but nothing has been opened or sent.
Step 2: Check the sender and the link
Look at the real sender address and hover over the link to see where it truly goes. Do not use the contact details inside the message.
You should see: You can see whether the domain belongs to the organisation you know.
Step 3: Verify by another route
Open the organisation's official app, or type its web address yourself, or use the telephone number printed on your card or bill. Check whether there is really a problem.
You should see: The real account shows no alert, which confirms the message was false.
Step 4: Report and delete
Use your email program's Report phishing or Report junk button if it has one. Then delete the message. If it came from your workplace or school, forward it to the person who handles IT security as they instruct.
You should see: The message leaves your inbox and your provider learns about it.
A note on unsubscribe links. In mail from companies you have really dealt with, the unsubscribe link is usually safe. In spam from unknown senders, clicking it can confirm that your address is live. For unknown senders, use Report junk instead.
Protecting your email account
Because your email account can reset all your other accounts, it deserves the strongest protection you can give. There are four steps. First, use a long, unique passphrase that you use nowhere else, ideally kept in a password manager. Second, switch on multifactor authentication, so that a stolen password alone is not enough. Third, set up recovery options. Fourth, review the account's activity from time to time.
Your email account
Read this figure as text
A stack of four layers showing the protections for an email account.
A stack of four layers from top to bottom. Layer 1: multifactor authentication, a second proof such as a code from an app. Layer 2: a long unique passphrase, used on no other site. Layer 3: recovery options, such as a second email address, a telephone number and recovery codes kept safely. Layer 4: your habits, which means checking senders, not clicking links and keeping your device updated.
Recovery is how you get back into your account if you forget the password or someone locks you out. Most providers let you add a second email address, a telephone number and printed recovery codes. Keep this information current. If you change your phone number and forget to update it, you may lose access when you need it most. Store recovery codes on paper in a safe place, not in the same inbox they protect. Never give a recovery code or a one-time code to anyone who contacts you, even if they say they work for your provider.
To check your account, look in its security settings for a section named something like Security, Recent activity or Devices. It shows when and from where your account was last used. Sign out any device you do not recognise, then change your password. Also look at the settings for forwarding and filters. Criminals who briefly get in sometimes add a rule that quietly forwards copies of your mail to themselves. If you find a rule you did not create, delete it.
Finally, a few words about forgotten passwords. Use the Forgot password link on the genuine site, which you reach by typing the address yourself or using your bookmark. The provider will send a reset message to your recovery email or phone. If you receive a reset message that you did not ask for, ignore it, and consider changing your password, since someone may be trying to enter your account.
Common mistakes
✖ Instead of: Trusting an email because it shows a familiar logo and company name.
✔ Do this: Check the real sender address and the true destination of links, then confirm using an app or number you already trust.
✖ Instead of: Replying to spam to ask them to stop.
✔ Do this: Do not reply. Use the Report junk button, which also trains your filter.
✖ Instead of: Using the same password for email and other sites.
✔ Do this: Give your email a unique passphrase and turn on multifactor authentication.
✖ Instead of: Phoning the number given in a suspicious message.
✔ Do this: Use a number printed on your card, bill or the official website you typed yourself.
If something goes wrong
- A genuine message went into the Spam folder.
- Open it, check that it is real, then use Not spam or Move to inbox, and add the sender to your contacts so future messages are trusted.
- I get a code or reset email that I did not ask for.
- Do not use or share the code. Someone may have typed your address into a login page. Change the account's password and check that multifactor authentication is on.
- I cannot sign in and the recovery code does not arrive.
- Check the telephone number or address that the provider says it will use. Look in Spam, wait a few minutes before asking again and use the provider's official recovery page. Do not use an unofficial help number from a search advert.
- My friends say they got strange emails from me.
- Change your password from a clean device, enable multifactor authentication, sign out all devices, check for forwarding rules and tell your contacts not to click.
Key terms
- spam
- Spam is unwanted email sent in bulk, usually advertising or scams.
- spoofing
- Spoofing is faking the sender of a message so that it appears to come from someone you trust.
- Phishing
- A trick message that pretends to be from a trusted source to make you give away passwords or money.
- Multifactor authentication (MFA)
- Signing in with your password plus a second proof, such as a code from your phone.
- Recovery code
- A one-time code, saved safely, that lets you get back into an account if you lose your phone or second step.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Review your email account's security
Open your email provider's account or security settings by typing its address yourself. Look for the recovery email, the recovery telephone number, the list of signed-in devices and whether multifactor authentication is on. Do not type your password into anything except the provider's own login page, and do not show any code to anyone. Write on paper which of the four layers you already have.
Mark up a suspicious message
Look at the junk or spam folder of your own account, or the simulated message in this lesson. Without clicking anything, choose one message and write down at least five clues that it is suspicious or, if it looks genuine, five checks you made. Decide what you would do next and why.
Knowledge check
6 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- Spam is unwanted bulk mail; phishing is a message that tries to trick you.
- Warning signs: a strange sender domain, a generic greeting, urgency, odd links and requests for secrets.
- Do not click, check by another route, report and delete.
- Protect your email account with a unique passphrase, multifactor authentication and current recovery options.
- Review sign-in activity and forwarding rules from time to time.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.