How can we tell if an email message is a phishing attempt?

In the online environment, there are various challenges that you can overcome if you have enough information to identify them quickly. Phishing is one of these challenges and represents an attempt to fraudulently acquire personal information through various impersonation methods (false identity).

Attackers periodically generate phishing campaigns, usually through carefully crafted email messages, with the purpose of obtaining banking or login personal information on various platforms used by victims. It is important for users to remain vigilant and to closely analyze the type of message received.

Common manifestation mechanism:

• Phishing messages are crafted to induce a state of urgency, pressure, or difficulty. For example:
• Suggests the need for quick updates of personal data on a specific website or link.
• Imitation of the visual identity of a bank, a known program, or service.
• The content of the message is visually and textually similar to that of the impersonated entity.

* Pay attention to the following elements in suspicious messages:

1) Email address: From (the sender)

• The address may appear legitimate, such as:
  • A banking institution;
  • A known contact;
  • An online service (e.g.: control panel, email, etc.);
  • A utility company (gas, electricity, internet);
  • An online store or a social network.

  Attention! Even if the sender's name seems correct, you should always check the email address from which the message was sent.

  

  2) Email address: Reply-To or Return-Path (recipient for replies)

  • The real address of the attacker differs from the one displayed in the From field.
  • You can check these addresses in the email headers, accessible in the email client used (e.g., View Headers or All Headers).

  Inside the headers, the Return-Path and Reply-To fields reveal the real address of the sender. If they differ from the address displayed in the From field, the message is suspicious.

  3) The links in the message

  • Links can open fake pages that mimic legitimate sites.
    
  • These may include forms for collecting personal details.

  4) Message attachments

  • Attachments may contain seemingly legitimate but infected files.
    
  • Opening these can execute malicious code, download viruses, or redirect to unsafe pages.

  5) Other suspicious elements

  • Any unusual detail or one that raises suspicions in the message.

  Recommendations:

  • * Do not open emails from unknown sources.
  • * Avoid accessing links or attachments in such messages.
  • * Do not fill in personal information in suspicious forms.
  • * If you have already filled in personal information in such a form, immediately change the password of the compromised account.
  • * For suspicious messages, consult the technical department of Hostico.
  • * Periodically check the articles on the National Cyber Security Directorate (DNSC / CERT-RO).