Lessons · Cybersecurity · checking a suspicious email, in order
The order to check a suspicious email
Check a suspicious message in a fixed order: the real sender, then where the links really go, then what is being asked for, then the pressure, then verify on a channel of your own, then report it.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The clerk who stops at the right moment does not do it because she is suspicious; she does it because she has an order to follow and the order does not let her reach the payment screen until the sender has been read. Habits beat instincts at 4 p.m. on a Friday.
How to think about it
The order matters because each step is cheaper than the next. Reading an address takes two seconds; phoning a supplier takes five minutes. Do the cheap checks first, and do not skip to verifying because the request looks reasonable.
Worked example
1. The real sender address, not the display nameTwo seconds, and it catches most of them.
2. Where the links actually pointThe text of a link and its destination are different things.
3. What it asks for: money moved, credentials, an attachment openedThe three requests worth stopping for.
4. The pressure: a deadline, a threat, a secretUrgency plus an unusual request is the pattern.
5. Verify on a number or address you already had, then reportReport even when you did nothing, because the next person got it too.
Your turn
You decided the email was phishing and did not click. Write the last step anyway.
last step: it
Solve one, graded on the server
The trap
Replying to ask whether it is genuine. The reply goes to whoever sent it, and 'yes, it is really me' is the easiest email they will write all day.