URLs Are Only Half the Story
Latest Scams Image 2

URLs Are Only Half the Story

If you’ve taken security awareness training, you have probably been taught to hover your cursor over a link to view the destination URL. Checking the URL for things like misspellings, unofficial domain names, and sneaky subdomains is a great way to protect yourself against phishing links. But, the URL could appear legitimate and still lead you to something malicious. Cybercriminals can use hijacked websites, websites that appear safe, or services like Dropbox or Google Drive to spread their phishing attacks.

While you should definitely make a habit of checking links before clicking on them, it is important to know the other red flags to look for in a suspicious email. Try examining the email by asking yourself some of the following questions:

  • Is the body of the email specifically addressed to you?
    • If the email starts with “Dear User” or any other vague term instead of your name, this could indicate that the email is a phishing attack that was sent to a number of other people.
  • Are there obvious spelling or grammatical errors?
    • Nowadays, spell checking is built into most email clients and mobile keyboards. Obvious spelling and grammatical errors could indicate that the message has been poorly translated from one language to another.
  • Was the email received at a strange time?
    • If the email was not sent during business hours or at a reasonable time in relation to your location, this could indicate that the sender is in another country. 
  • Were you expecting this email?
    • For example, if the email says you have a delivery ready for pick up, think about whether or not you made a recent purchase.
  • Is there a sense of urgency in the email?
    • Cybercriminals love creating a sense of urgency to trick you into impulsively clicking on a link or opening an attachment. Consider phrases like “ACTION NEEDED” to be a red flag.
  • Are you being asked to do something that isn’t typically part of your role?
    • For example, if you are in customer service you wouldn’t typically be asked to provide information about the organization’s financial statements.

If you still struggle to determine the legitimacy of an email, try looking outside of your inbox. For example, if you receive a notification email from a service you use, open your browser and navigate to the official website. Then, log in to your account to verify the legitimacy of the notification email. Or, if you are contacted by an individual, call the sender to confirm that the email really came from that person.

Knowbe4 Logo

Stop, Look, and Think. Don’t be fooled.

Like this article?

Share on Facebook
Share on Twitter
Share on Linkdin
Share on Pinterest

More Posts

Incognito Mode Image

3 Myths About Incognito Mode

In today’s digital age, protecting our online privacy has become increasingly important. Many users turn to incognito mode, also known as private browsing, believing it

Hacker Fire Image

Insights from 3.5 Billion Cyber Attacks

90% involve social engineering (see below)   In the realm of cybersecurity, the ability to predict and prepare for attacks is invaluable. Much like how

Deepfake Image

Deepfake Voice Phishing

How It WorksDeepfake technology uses artificial intelligence to mimic voices with astonishing accuracy. Scammers obtain samples of the target’s voice, often from social media or

SuperPod with WiFi 6E

Plume SuperPod WiFi 6E Specs

SuperPod with WiFi 6

Plume SuperPod WiFi 6 Specs


Plume SuperPod Secs