Email-based threats have become commonplace in Australia. According to the latest Notifiable Data Breaches Quarterly Statistics Report, a significant portion of data breaches in 2018 were caused by phishing scams. Phishing is successful because cybercriminals are using more sophisticated tactics. One particularly effective tactic is called “email spoofing.”

What is email spoofing?

Email spoofing is when cybercriminals forge email headers to make them look like they came from someone else. Spoof emails are often formatted to look like they are from well-known companies and websites. Unfortunately, this can trick people into divulging private information or downloading dangerous malware.

These scams are possible due to issues with Simple Mail Transfer Protocol (SMTP) servers. This technology is responsible for sending emails from person to person. The problem with SMTP is that it doesn’t verify email headers. This means all a scammer needs to do is use a free SMTP service, write a convincing scam, enter a fake email address, and hit send.

Scammers can also acquire a list of target email addresses through the dark web and instantly deliver spam to them using mass-mailing programs.

What do spoofed emails look like?

Cybercriminals alter different sections of an email to hide their identity. Most of the time, they slightly alter the name or email address of a legitimate company or individual. For example, a spoofed email address purporting to be from Paypal can be “[email protected].”

Another popular method is the business email compromise (BEC) scam, which involves impersonating a CEO or executive manager, This method tricks someone in the finance department to make fraudulent wire transfers. In fact, the Australian Scamwatch website reported that losses to BEC scams totalled $2.8 million in 2018. Unfortunately, there’s more to come in the year ahead.

Whoever the sender is, make sure to look closely at the email. If the address is randomised or does not match the sender’s name, the email is a spoof. Other tell-tale signs include poor formatting, glaring spelling errors, and over-the-top language that urges you to act quickly.

It’s also important to critically analyse the context of the email. Would any legitimate company ever request for wire transfers or credit card information over email? Do your friends ever send file attachments let alone contact you via email? Answering these questions will help you identify spoofed emails.

How can you defend against spoofed emails?

As with any online scam, a healthy dose of scepticism and discretion when checking your emails can go a long way. Avoid messages with suspicious links and attachments.

If your bank sends you an email asking for your financial details because your account has been frozen, don’t just comply right away. Contact your bank on a different channel and verify the authenticity of the email. Trustworthy companies will never ask for your personal information over email, which is why you need to double-check the sender’s address when you see these types of messages.

Training employees on security best practices will also significantly reduce the risk of online scams. BEC scams, for instance, may be a popular tactic among cybercriminals, but it’s effectiveness drops when employees can spot fraudulent emails and are aware of the company’s wire transfer protocols.

Technical safeguards

For increased security, implement a Sender Policy Framework (SPF). This is an email validation system that enables you to specify which domains are allowed to send emails to your company’s email server and blocks messages from untrusted domains.

When paired with spam filtering software, you dramatically minimise the chances of spoofed emails reaching your inboxes. Cutting-edge email services like Microsoft Exchange Online let you filter messages based on the:

• sender,
• content of the email, and
• region the message was sent from.

Getting the latest threat detection and anti-malware solution will allow you to scan emails for dangerous links and attachments.

If you’re looking for cutting-edge email security solutions that keep spoofed emails at bay, Empower IT Solutions is the answer. Not only do we provide robust spam filtering, SPF, and anti-malware, we also offer round-the-clock network monitoring and comprehensive security training services customised for your business. Give us a call today to learn more.