Five Phishing Email Scams and How to Spot Them
Summary
The article explains five phishing scenarios—including fake financial alerts, callback scams, QR-code lures, and a stock-option simulation—and offers tips for recognizing suspicious emails.
Key points
- Fake bank and PayPal alerts use fear and urgency to trick recipients into entering login details on fraudulent pages.
- A Geek Squad-themed callback scam directs victims to call a number, where an adversary may persuade them to run a ScreenConnect installer for remote access.
- A QR-code lure claims messages are quarantined and asks recipients to scan a code that leads to a malicious website or malware download.
- A stock-option grant lure can target employees; the example described was a benign internal phishing simulation.
- The article advises checking sender details, treating urgent requests cautiously, hovering over links to inspect their destinations, verifying sensitive requests through official channels, and watching for spelling or grammar errors.
Article Details
- Topic
- Phishing email examples, social-engineering tactics, and guidance for recognizing phishing attempts
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe article describes phishing pages prompting victims to enter banking or account login credentials.T1219 · Remote Access ToolsIn one example, a victim is persuaded to run a ScreenConnect installer that gives the adversary remote access.T1566 · PhishingThe article describes phishing emails used to deceive recipients into clicking links, scanning QR codes, or calling a phone number.
Vendors
Products
AmazonKnowing they didn’t spend hundreds of dollars at Best Buy and Amazon, the user would click on the link to “report” the charges.Best BuyKnowing they didn’t spend hundreds of dollars at Best Buy and Amazon, the user would click on the link to “report” the charges.Chase BankThis would bring them to a malicious site that looks like Chase Bank, where they would enter their banking login details… straight into the attacker’s hands.PaypalExample 2: The PayPal Password PloyScreenConnectIn this instance, the installer is a ScreenConnect installer, which will allow the adversary remote access into that environment.
Tools
Domain DossierYou can also use tools like Domain Dossier to learn about domain names and IP addresses, ICANN to see who domains are registered to, and urlscan.io to show a screenshot of the page you’d land on if you were to follow aICANNYou can also use tools like Domain Dossier to learn about domain names and IP addresses, ICANN to see who domains are registered to, and urlscan.io to show a screenshot of the page you’d land on if you were to follow aurlscan.ioDossier to learn about domain names and IP addresses, ICANN to see who domains are registered to, and urlscan.io to show a screenshot of the page you’d land on if you were to follow a link.