What is a phishing email example: one, taken apart

A worked example, and the three things wrong with it

The Federal Trade Commission publishes one specific message as its example and then lists what gives it away. Its framing is worth keeping, because it starts from the difficulty rather than from the answer: “At first glance, this email looks real, but it’s not. Scammers who send emails like this one are hoping you won’t notice it’s a fake.”

Then the three signs, “even though it looks like it comes from a company you know — and even uses the company’s logo in the header”:

One, the greeting is generic. A company that has your money also has your name, and uses it.

Two, the reason is a billing problem. The FTC’s wording: the email “says your account is on hold because of a billing problem”. That is a story chosen because it produces urgency without alarming you enough to phone anybody.

Three, it invites you to click a link to update your payment details — and this is the one that does not need the other two. The FTC states the rule flatly: “legitimate companies won’t email or text with a link to update your payment information.” That single sentence settles most of these on its own, without any inspection of the message at all.

The FTC also lists the stories these messages tell, each with its own correction attached. They may “say they’ve noticed some suspicious activity or log-in attempts — they haven’t”; “claim there’s a problem with your account or your payment information — there isn’t”; “say you need to confirm some personal or financial information — you don’t”; “include an invoice you don’t recognize — it’s fake”; “say you’re eligible to register for a government refund — it’s a scam”; or “offer a coupon for free stuff — it’s not real”.

What to look at, and what is worth nothing

Most advice on this subject starts at the top of the message and works down, which is the order that suits the attacker. The useful order is the reverse.

The display name is worth nothing. It is a free text field chosen by whoever sent the message; there is no check on it anywhere in the system. A message can say it is from your bank for the same reason a letter can say it is from your bank: because somebody wrote that.

The address behind it is worth a look, and only just. A lookalike domain survives a glance perfectly well. CISA gives the shape of it: “Incorrect email addresses or links, like amazan.com” — the bold letter is CISA’s own. If you are hunting for a swapped letter you have already spent longer on the message than it deserves.

What it asks you to do is worth everything. The request is the only part that cannot be disguised, because it is the point of sending the message at all. Google’s own list of what these messages do is four items long: they may “Ask for your personal or financial information”, “Ask you to click links or download software”, “Impersonate a reputable organization, like your bank, a social media site you use, or your workplace”, and “Impersonate someone you know, like a family member, friend, or coworker”. Google adds the sentence that closes off the visual approach entirely: such a message may “Look exactly like a message from an organization or person you trust.”

So the check that works is not about the message. It is: does what this is asking me to do make sense as a thing this organisation would ask by email? If the answer is no, nothing about how convincing it looks changes that. And if the answer is unclear, the FTC gives the exit — “contact the company using a phone number or website you know is real — not the information in the email.”

Recognise, resist, delete

CISA reduces the whole of it to three words, and the middle one is the one people skip.

Recognise. Its list of signs: “Urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately”; “Requests to send personal and financial information”; “Untrusted shortened URLs”; and the lookalike addresses above.

Resist. In CISA’s words: “If you suspect phishing, resist the temptation to click on links or attachments that seem too good to be true and may be trying to access your personal information. Instead, report the phish to protect yourself and others.”

Delete. And this one has a detail worth having: “Delete the message. Don’t reply or click on any attachment or link, including any ‘unsubscribe’ link. Just delete.” The unsubscribe link is the trap inside the trap, because using it feels like the responsible thing to do and confirms the address is read by a person.

If you are unsure whether a message might be genuine, CISA gives the same exit the FTC does, with the extra case for a message that appears to come from somebody you know: “Use another way to reach the person to confirm whether they contacted you.”

How to report a phishing email, in three places

The three destinations are not alternatives to one another — they do different jobs, and most advice on this subject names one and stops.

An email goes to the Anti-Phishing Working Group. The FTC’s instruction: “If you got a phishing email, forward it to the Anti-Phishing Working Group at reportphishing@apwg.org.” That is an industry body that pools reports across providers, so a message reported there can be blocked for people who do not use your mail provider.

A text message goes to 7726. “If you got a phishing text message, forward it to SPAM (7726).” Those four digits spell the word on a keypad, and the report goes to your own mobile network.

Either of them also goes to the FTC. “Report the phishing attempt to the FTC at ReportFraud.ftc.gov.” That is the one that feeds enforcement rather than filtering.

And reporting inside your mail program is a fourth, separate thing. It is worth doing and it is not a substitute. In Gmail the route Google publishes is four steps: open the message, click More next to Reply, and click Report phishing. Google notes what that does with the message: “When you manually move an email into your Spam folder, Google receives a copy of the email and any attachments”, which it may analyse “to help protect our users from spam and abuse”. It trains that provider’s filter. It does not reach the APWG, your mobile network or the FTC.

If the message arrived in Outlook, the clicks are different and they have their own page, which also explains why reporting does not block the sender.

If you already clicked, or already replied

The FTC splits this into two cases, and they need different things.

If you gave up information. “If you think a scammer has your information, like your Social Security, credit card, or bank account number, go to IdentityTheft.gov. There you’ll see the specific steps to take based on the information that you lost.” That site is run by the FTC and it costs nothing; what it does and the deadlines that start now are set out separately.

If you clicked or opened something. “If you think you clicked on a link or opened an attachment that downloaded harmful software, update your computer’s security software. Then run a scan and remove anything it identifies as a problem.” If the scan finds something, or if the machine has started behaving differently, removing it is a separate job.

And in both cases, if a password was typed into the page the link led to, that password is gone — not just for that site but for every site it was reused on. Changing it there and everywhere else is the actual repair, and how to stop reusing them is the thing that makes the next one of these harmless.

The FTC’s own preventive list is four items and the third is the one that survives a successful phish: “Protect your accounts by using multi-factor authentication… Multi-factor authentication makes it harder for scammers to log in to your accounts if they do get your username and password.” Which is exactly why the next message asks for the code instead — and why a code you did not request is worth understanding before somebody asks you for one.