Scams and Scammers – Email

Email is one of the most common ways scammers reach people. Phishing emails — messages made to look like they come from someone you trust — try to get you to click a link, open an attachment, call a number, enter a password or send money. A single click can lead to a stolen account, an infected computer or a ransomware attack. The good news: once you know what to look for, most phishing emails are easy to spot.

What phishing emails look like

• Account alerts. “Your account has been locked,” “Unusual sign-in detected,” or “Your password expires today,” with a link to a fake sign-in page.
• Fake invoices and receipts. A bill or order confirmation you don’t recognize, with a phone number to call “if you didn’t authorize this.” The person who answers is a scammer.
• Delivery notices. A package is “on hold” and you need to confirm your address or pay a small fee.
• Shared documents. Someone has “shared a file” or “sent a document to sign,” and you need to log in to see it.
• Prizes, refunds and tax messages. Money you’re owed — once you provide your bank details.
• QR codes. A code in the email to scan with your phone, which takes you to a fake website and gets around your computer’s protections.
• Threats. “I have your password” and “I recorded you through your webcam” emails — see What Is Cyber Extortion?

Why businesses are prime targets

Scammers research businesses using their websites, social media and public records to write convincing, targeted messages. One of the most costly scams for small businesses is the fake payment request: an email that appears to come from a supplier, client or the owner, asking for an urgent payment or announcing that a supplier’s bank details have changed. Sometimes it comes from a real, hacked email account, so the address looks right.

Rule of thumb: never change payment details or send an unusual payment based on an email alone. Confirm by phone, using a number you already have — not one in the email.

How to spot a phishing email

1. Slow down. Scammers rely on urgency — “act now,” “within 24 hours,” “final notice.” If a message pressures you, set it aside and come back to it calmly.
2. Ask whether it makes sense. Do you actually have this account? Were you expecting this invoice, package or document? An unexpected message deserves extra suspicion.
3. Look at the real sender address, not just the name. The display name can say anything, such as “Netflix” or your bank. On a computer, look at the address next to the name; on a phone, tap the sender’s name to reveal it.
4. Read the domain correctly. The part that matters is the name just before the ending (.com, .net, .org and so on), right before the slash in a web address. More on this below.
5. Check links before you click. On a computer, rest the mouse pointer over a link to see where it really goes. On a phone, press and hold the link to preview it. If it doesn’t lead to the real company’s website, don’t open it.
6. Be wary of attachments. Don’t open attachments you weren’t expecting — especially ZIP files, web page (HTML) files, or documents that ask you to “Enable editing” or “Enable content.”
7. Don’t rely on spelling mistakes or your name. Many phishing emails are now well written, often with the help of AI, and scammers frequently use your real name from breached data. A generic greeting is a warning sign; a personal one proves nothing.
8. Verify another way. If a message claims to be from a company or person you know, contact them using a phone number, website or app you already know — never the contact details in the message.

Reading a sender’s domain

Companies often send email from different addresses, but the real ones all end with the company’s own domain. Using Netflix as an example:

• info@netflix.com — genuine.
• info@mailer.netflix.com — also genuine. Text before the company’s domain (here, “mailer.”) is normal.
• info@netflix-support.com — fake. This is a different domain that simply contains the word “netflix.”
• info@netflix.com.account-verify.ru — fake. The real domain is the part at the very end, account-verify.ru.
• info@netf1ix.com — fake. Look closely: the “l” is the number one.

The same rule applies to links: the part just before the first single slash is the real website. A correct-looking address isn’t a guarantee, though — real accounts sometimes get hacked and used to send scams — so unexpected requests for money or passwords should always be verified another way.

Protect yourself

• Use your email’s spam and phishing filters, and mark scam messages as spam or phishing to help train them.
• Sign in by going to websites yourself — type the address or use the official app — rather than following links in emails.
• Use a password manager. Besides creating strong, unique passwords, it won’t fill in your password on a fake website whose address doesn’t match — a useful warning sign.
• Turn on two-step verification for your email, banking and other important accounts, so a stolen password alone isn’t enough.
• Keep Windows, your apps and your antivirus up to date. See Antivirus and Antispyware: How They Protect You.
• Keep good backups, so a malicious attachment can’t cost you your files. See Data Backup: How to Protect What Matters Most.

If you clicked a link or opened an attachment

• If you entered a password, change it right away by going to the real website yourself — and change it anywhere else you used the same password. Turn on two-step verification.
• If you opened an attachment or downloaded something, disconnect the computer from the internet and run a full antivirus scan. If anything seems wrong — or a ransom message appears — get professional help.
• If you shared bank or card details, call your bank or card company immediately using the number on your card.
• If a business payment was sent, contact your bank immediately — the sooner, the better the chance of recovering it — and report it to the FBI at ic3.gov.

Report phishing

• Use the Report phishing or Report spam option in your email program (Outlook, Gmail and others have one).
• Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, as the FTC recommends.
• Report scams that cost you money or information to the FTC at reportfraud.ftc.gov.

Need help?

Not sure whether an email is genuine, or worried you clicked something you shouldn’t have? Call PSA at (707) 506-6802 or send us a message. For businesses, we can also help set up email filtering and two-step verification to stop phishing before it reaches your staff.