Email help
Phishing and spear phishing: how to spot them
Phishing emails try to trick you into clicking a link, opening an attachment or handing over a password. Here’s how to recognize them and what to do.
Phishing
Sent to thousands of people at once. Usually pretends to be a bank, the IRS, a delivery company, Microsoft or a store like Amazon.
Spear phishing
Aimed at you or your business. Uses real names and details to look like it comes from your boss, a coworker, a vendor or a client.
Warning signs
- You weren’t expecting it, and it asks you to act right away.
- Urgent or threatening language: an account “suspended,” a payment “overdue,” a package “on hold.”
- The sender’s address doesn’t match the company, or is a slight misspelling of one you know.
- Links that go somewhere unexpected. Hover over a link (or press and hold on a phone) to see where it really goes.
- Attachments you didn’t ask for, especially invoices, zip files or documents that ask you to “enable content.”
- Requests for passwords, gift cards, wire transfers or changes to payment details.
The padlock isn’t proof
Most phishing sites now use https and show a padlock too. The padlock only means the connection is encrypted, not that the site is who it claims to be. Check the address itself.
Protect yourself
Check another way
If a message asks for money or a change to payment details, call the person or company using a number you already have, not one in the email.
Go there yourself
Instead of clicking a link, type the company’s address into your browser or use their app.
Use a password manager
Use a different, strong password for every account. A password manager creates and remembers them for you.
Turn on two-step sign-in
Add a code from your phone to your bank, email and other important accounts, so a stolen password isn’t enough.
Keep things updated
Install updates for your computer, phone and browser promptly. They fix the holes attackers use.
Watch your accounts
Review bank and card statements regularly, and report anything you don’t recognize right away.
Clicked something you shouldn’t have?
- Don’t enter anything else. Close the page.
- Change the password for that account right away, and anywhere else you use the same password.
- If you entered card or bank details, call your bank.
- Let us know: open a support ticket or call (831) 338-3333. If it was your iHwy email password, we can help secure your mailbox.