Module 2 · 2.4

English

Nederlands English Deutsch Français Español

Recognising phishing in your webmail

Module 2: Reading email · Reading time: 10 minutes

Learning objective: After this lesson you will recognise the signs of a phishing email, you can check in your webmail where a link and a reply really go, and you know what to do with a suspicious email and what to do if you did click.

Key concepts: phishing, link text, real link, domain name, subdomain, lookalike domain, Reply-To, warning about suspicious addresses, Report spam, another channel

What phishing is

Phishing is an email that tries to tempt you into doing something that helps the sender: logging in on a fake page, making a payment, opening an attachment or sending back details. The word comes from fishing: the attacker casts a line and waits to see who bites.

Most phishing is not about your computer, it is about you. Often there is no virus in it at all. The email simply wants you to do something yourself. That is why a virus scanner only helps a little, and why knowing the tricks helps a lot.

The standard ingredients

Almost every phishing email uses one or more of these tactics:

Urgency: "within 24 hours", "today", "final reminder". People in a hurry check less.
Threats: your mailbox will be closed, your domain is expiring, there is an unpaid direct debit, your parcel is being returned.
Reward or curiosity: a refund, a shared document, a voicemail.
A button or link to a page that looks like the one from your bank, your provider or your webmail.
A sender or domain that is almost right.
A different reply address, so your reply ends up with the scammer.

An email with urgency and a link to a login page always deserves a second look, even if it looks neat. Good phishing no longer has spelling mistakes.

Link text and real link

In an email, the text you see and the address the link goes to are two different things. In the source of an email it looks like this:

<a href="https://login.weboke.nl.account-check.example/inloggen">
  https://webmail.weboke.nl
</a>

You see https://webmail.weboke.nl, but you go to a completely different address. On a computer you check it like this: point at the link or button with your mouse, without clicking. The real address appears at the bottom of the browser window. On a phone or tablet, press and hold the link; you get a menu with the address at the top. Then do not choose open.

Reading a web address

You also need to be able to read the real address properly. Look at the part between https:// and the next slash. Read it from right to left: the extension (.nl, .com, .example) and the word before it together form the domain name. That is the part that counts.

https://webmail.weboke.nl/ : the domain name is weboke.nl. The part webmail in front of it makes it a subdomain; only the owner of weboke.nl can create that.
https://login.weboke.nl.account-check.example/inloggen : the domain name is account-check.example. Everything in front of it ("login.weboke.nl") is a subdomain the attacker chose. This is the best-known trick.
https://weboke-beveiliging.example/ : a lookalike domain. It contains a familiar name, but it is a different domain that anyone can register.
https://www.example.com@account-check.example/ : everything before the @ is ignored; you go to account-check.example.

Some domains also use letter tricks: a number 0 instead of the letter o, rn instead of m, or letters from another alphabet that look the same. If you cannot see the difference with the naked eye, a password manager helps: it only fills in your password on the real domain (lesson 1.3).

Sender and Reply-To

In lesson 2.2 you saw that the display name proves nothing and that Reply-To can have an address of its own. In phishing these two often come together. The email claims to come from "WebOké Support", the address is support@weboke-beveiliging.example, and Reply-To points to a free email address. Or the email comes from your director's real address, but Reply-To points to a different domain. You often see the latter in CEO fraud: an "urgent payment" the director supposedly asks for from a meeting.

The webmail helps a little. If the sender's address contains characters that look like ordinary letters but are not, the webmail shows a warning above the message saying the message contains email addresses that may not be trustworthy. If you see that warning, treat the email as suspicious. If you do not see it, that means nothing: most phishing simply uses a different domain.

And remember from lesson 2.2: an email that passes SPF, DKIM and DMARC can still be phishing. The attacker is then using their own, real domain.

What to do with a suspicious email

Do not click, do not reply, do not open attachments. Not even "just to have a look".
Go to the site yourself. Is the email about your bank, your provider or a parcel? Open the site or app the way you always do, using a bookmark or by typing the address yourself. If there is nothing there, the email was fake.
If in doubt, call, on a number you already had, not a number from the email.
Report the email. In WebOké's webmail, use Report spam: the message goes to WebOké's spam team and to your Spam folder. If the email is about your bank, also forward it to that bank's reporting address. In the Netherlands you can also report phishing to the Fraud Helpdesk (Fraudehelpdesk).
Warn your colleagues if the email went to more people in your organisation.

Clicked or logged in anyway?

It can happen to anyone. Acting quickly makes the biggest difference.

Change your password straight away, from a device you trust, and also everywhere else you used the same password.
Turn on two-step verification (lesson 8.1).
Check your mailbox for traces. Attackers who get into a mailbox often create a filter that forwards or hides email, or they change the Reply-To in your identity. Look under Settings > Filters, Settings > Identities and Out of Office for anything you did not create yourself.
Did you enter payment details? Call your bank immediately.
Is your mailbox suddenly sending spam? Report it to your provider.

In practice: how it works in the webmail

In the webmail, point at a link to see the real address at the bottom of your browser. With Details you see the sender's address, and in the compose screen you see where a reply will go. The Report spam button is above the message.

The Report spam window asking whether you want to report this message as spam, with the options below — The Report spam window

The image shows the window that appears when you click Report spam. The Roundcube manual describes it under Reporting spam with Report spam. Other webmail, such as Gmail or Outlook.com, works in a similar way: there the button is called, for example, Report phishing or Report.

Summary

Phishing works with urgency, threats, a link to a fake page and a sender that is almost right.
Link text and real link are different: point with your mouse, or press and hold on your phone.
Read the domain name from right to left; everything in front of it is chosen by the owner of that domain.
Reply-To pointing to another domain and the warning about suspicious addresses are signals; a passed DMARC check proves nothing about trustworthiness.
Do not click, go to the site yourself, report it; clicked anyway: change your password and check your filters and identities.

Quiz

Exercise

Exercise A2.4: Analysing a suspicious email. The material phishing-1.eml is below this exercise. Open it as text (for example in Notepad or TextEdit, not in your email program) and find the headers From and Reply-To and the address behind the button in the content (the href). Fill in: the real sender domain, the domain the button really goes to, the Reply-To domain, and choose whether you trust the email. The program compares your answers with the answer key and shows for each question where you could have found it in the file.

Cookies at WebOké

Cookie settings

Necessary

Marketing