General tips
To view images in a larger size, right-click it and click 'Open in new tab'
- The ‘Display Name’ of the email address means nothing!
- Ex: email address is thutchinson@tacada.ca and Display Name is “Tally Hutchinson”. Anyone can set their Display Name to be anything they want when they create their email account.
- Email addresses themselves sometimes also mean nothing!Email addresses can be spoofed very easily. This means that an attacker can not only control the Display Name but the Email Address as well.
- This is why sometimes you receive a spam email from “yourself” even though you see nothing in your Sent Items folder
- Hover your cursor over a hyperlink to see the actual URL of the webpage it’s trying to send you to
- Depending on your email client, it might show in a popup beside your cursor or it might show in the bottom left corner of your screen.
- If you think you've fallen for an email scam, contact Helpdesk right away. These are usually time-sensitive matters.
Gift Card scam
Description:
Someone you know emails or texts you to do a favor for them. They need you to buy some gift cards (most commonly iTunes / Amazon) for them right away, as they’re in a meeting with an important client and needs the gift card codes right away. In reality, it’s just a scammer posing as your contact. Do not, under any circumstances, send them any gift card codes.
Example:
Prevention:
- Closely inspect the actual email address of the sender, not just their display name.
- NEVER give a gift card code to someone over text/email.
- Additionally, any bulk gift card purchases are to be made by Marketing, not directly by employees.
Package Delivery scam
Description:
You receive an email out of nowhere about a package being delivered to you. You may or may not be expecting a package, so you decide to click the link to see what’s being delivered. Once on their webpage, it may try to download a virus, it may get you to sign in to your email address to steal your credentials, or something else.
Example:
Prevention:
- Note the email address domain (eg. @tacada.ca, @daytonahomes.ca, @gmail.com, etc.) if it’s not even close then that’s a red flag.
- Be aware of what you have ordered and which shipping company it’s coming from.
- Hover your cursor over links to reveal the actual URL of the website it’s sending you to. If it does not match what you are expecting (ie. DHL.com/Logistics.dhl for DHL, canadapost.ca for Canada Post, etc.) then it's probably a scam.
- If a file does get downloaded, DO NOT run/open it. Immediately delete it. Most of the time, as long as you don’t actually RUN the virus file, deleting it should be good enough.
Porn Blackmail scam
Description:
Someone contacts you claiming to have a personal video recording of you watching porn. They demand payment, usually in Bitcoin, to not send the video to your contacts.
Example:
Prevention:
- Ignore/delete it. They do not have any videos of you, don’t worry.
Fake Sharepoint Login scam
Description:
You get an email that says a document has been shared with you via Sharepoint and you need to open a link to view the file. When you click the link it takes you to an Office365 login page where you enter your email address and password but…. nothing happens! It says the email address or password is incorrect so you keep trying, maybe try different passwords as well but nothing lets you in.
The login page it took you to was fake and created to look similar to the real Office365 login page. All it does is send the info you typed in the ‘Email address’ and ‘Password’ boxes to the attacker. Once they have your password, they use your email account to propagate the infection to all of your contacts.
Example:
Prevention:
- Inspect the email address for any suspect text (unfamiliar email domain, gibberish in the email address, stuff like that)
- Hover your cursor over the link to view the URL it’s trying to redirect you to. If it’s not what you’d expect to see or if it’s suspicious, it’s probably a scam but feel free to ask IT to verify.
- Be wary of fake “This message is from a trusted source”-type banners.
Fake Office365 Login scam
Description:
You get an email from an automated system that says you need to log in to Office365 in order to: view undeliverable emails, fix an error, change your password, or something along those lines.
Example:
Prevention:
- Inspect the email address and domain of the sender. Official Microsoft emails usually come from the domains @microsoft.com or @messaging.microsoft.com.
- Hover your cursor over a link to view the URL it’s trying to redirect you to. If it’s not the actual Office365 website (office.com) then it’s likely a scam. Send it to Helpdesk to verify if you are unsure.
Password Expiry/Missed Notifications scam
Description:
You get an email from an automated system that says your password has expired or that you have unread notifications or something like that.
Example:
Prevention:
- Inspect the email address that the email came from. Legitimate password expiry notices come from "help@daytonahomes.ca" or "help@tacada.ca"
- Always hover your cursor over the link to see the real website it's trying to send you to. If it's suspicious at all, send it to Helpdesk for us to check it out.
- Microsoft's auto-generated emails typically do not have big obvious misspellings. That is a red flag.