Scam emails—also known as phishing emails—are a common tactic used by cybercriminals to trick individuals and businesses into handing over sensitive information. These emails often attempt to steal passwords or install malware on your device.
With more of our lives taking place online and phishing attempts growing more sophisticated, it’s crucial to know how to spot a scam email. Ask yourself the following five questions before clicking on anything.
1. Is the Email Personally Addressed to You?
Legitimate emails, especially those involving accounts or payments, typically address you by name. Most companies use automation tools that insert your name after greetings like “Dear [Name].”
If the message begins with “Dear user,” your email address, or something generic, treat it with caution. That’s a red flag.
2. Who Sent the Email?
Always check the sender’s email address. Messages from trusted companies like Apple or Microsoft usually come from simple, official-looking addresses (e.g., support@apple.com or notifications@microsoft.com).
Phishing emails often use complicated or suspicious-looking addresses. Some even spoof legitimate names but send through random or unrelated domains (e.g., john.doe@purdue.edu claiming to be from Microsoft).
3. Is the Email Using Fear Tactics?
Scam emails are often designed to scare you into taking action. They might mention urgent issues, account suspensions, or unauthorised access, using words like:
-
“Emergency”
-
“Failure”
-
“Urgent”
-
“Final notice”
Legitimate companies don’t try to panic you. Instead, they explain issues clearly and calmly.
4. Where Does the Link Lead?
Before clicking on any link, hover your mouse over it (on desktop) or press and hold it (on mobile). This will show you the actual URL.
If the link doesn’t lead to the company’s official website, don’t click it. When in doubt, go directly to the site by typing the address into your browser.
5. Why Are They Asking You to Click?
Be skeptical if the email tells you to click a link to log in and check for updates or errors. For example, if your bank is experiencing a service disruption, they’ll inform you directly in the message—they won’t ask you to log in for more info.
Genuine emails rarely ask you to act urgently or provide personal information via clickable links.
Still Not Sure?
If you’re uncertain about the email’s legitimacy:
-
Call your bank or service provider using the official number from their website.
-
Do not use contact details from the suspicious email.
-
Report the phishing email to your IT team or government cybercrime reporting service (like ReportCyber).
In large-scale scams, companies are usually already aware and may issue official warnings on their websites or social media.
If you ask yourself these five questions and still feel like the email might be a scam, try calling your bank, or service provider and ask for more information. If it’s a large-scale scam, they’ve already been alerted to the situation.
