How to spot a phishing email: 3 real examples

A phishing email is a fake message that tries to trick you into sending money, giving up a password, or opening something harmful. Some are sloppy. Many look very real. The good news is that fakes almost always leave small clues, and once you know them, you start to see them.

Here are three examples that hit small businesses all the time, and the signs that give each one away.

The fake boss gift card email

Picture a front desk worker at a dental office in Bakersfield. She gets an email that appears to come from the owner, Dr. Ramirez. It says:

"Are you at your desk? I need a quick favor. I am stuck in a meeting and need to buy gift cards for a client. I will pay you back today. Please keep this between us."

The name on the email is right. But it is not really the doctor. A crook looked up the owner's name on the practice website and made a free email account with that name.

The small signs:

• The name looks right, but the email address behind it is a random Gmail or something close but off.
• The message is short and vague. It does not mention a real client or a real project.
• It asks you to keep it secret.
• It creates pressure. The boss is "stuck" and cannot talk.
• It asks for gift cards, which are hard to trace and hard to get back.

What to do: do not reply. Call or text your boss on the number you already have. Real bosses do not mind a quick check. A business should also have a simple rule that nobody buys gift cards or sends money based only on an email.

The lookalike login page

A contractor gets an email that says, "A document was shared with you." It looks like it came from Microsoft. He clicks the button and lands on a page that looks exactly like the Microsoft sign in screen. He types his email and password. Nothing seems to happen. But the crook now has his login.

This is one of the most common tricks because the fake page can look perfect. The clue is not on the page. It is in the address bar at the top of your browser.

The small signs:

• The web address is slightly wrong. It might say "rnicrosoft.com" (that is an r and an n, not an m) or "microsoft.securedocs.com". The real company name must be right before the first ".com" or ".org" and the first single slash.
• You were not expecting a shared document, or you do not know the sender.
• The link, when you hover over it with your mouse, goes somewhere different than the button says.

What to do: do not sign in from the email. Open a new browser tab and go to the real site yourself. If a file is really waiting for you, it will be there. A password manager helps too. It will not fill in your password on a fake site, and that is a useful alarm bell. Turning on two step sign in also means a stolen password alone is not enough.

The urgent account warning

You get an email that says:

"Your account will be closed in 24 hours. Verify your information now to avoid losing access."

It might claim to be from your bank, your payroll company, your email provider, or a delivery service. The goal is to scare you into clicking before you think.

The small signs:

• A threat and a deadline. Real companies rarely close accounts in a day over an email.
• A greeting like "Dear customer" instead of your name.
• A button or attachment you were not expecting.
• Odd wording, strange spacing, or a logo that looks a little blurry.
• A sender address that does not match the company.

What to do: slow down. Do not click anything in the message. Go to the company's website on your own, or call the number printed on your card or statement. If there is a real problem, you will see it there.

Why these emails look so real here

Many of these emails do not even need a lookalike address. In The Bakersfield Cybersecurity Report, we found that 86% of 4,406 local business domains had not published an enforced DMARC policy, the record that asks mail servers to quarantine or reject fake email in their name. Without it, a message faking your supplier's real address has a better chance of getting through, although mail providers still apply their own filters. That is why checking another way, by phone, matters more than checking the address.

Quick checks, and what to do if you clicked

Before you act on any email, ask yourself:

• Was I expecting this?
• Does the sender address, not just the name, look right?
• Is it rushing me or asking me to keep a secret?
• Is it asking for money, a password, or a code?
• Does the link go where it says it goes?

If you say yes to the last three or no to the first two, stop and check another way. Call the person. Go to the website yourself. Ask someone.