Holiday Email Hoax Reminder & Tips

As if things sometimes can’t get any crazier, this year I’ve encountered more sophisticated hoax emails than in years past. Many target the services and products we rely on or seek during the holiday season, and they’ve become pretty convincing.

Have you noticed that more emails are being sent this year for the holidays? With Black Friday, Cyber Monday, and other sales and specials designed to encourage online shopping, we are flooded with emails where scammers can easily slip in. There are sales, sales before the sales, and more sales even after. My inbox has been evidence of that for the past couple of weeks, and it’s not stopping.

Holiday Emails and Scammers

I don’t know about you, but at this point, I’ve started deleting anything with “Black Friday” or “Cyber Monday” in the title. I’ve also unsubbed from those who sent so many that it was darn right annoying. It was becoming exhausting.

With all that extra activity combined with more folks purchasing online, hoaxsters know how to take advantage of the fact that you are pressed for time, overwhelmed, or not paying attention as you should. And they go for the low-hanging fruit.

Hoax emails are disguised as order confirmations, financial alerts, and “feel-good” forwards to make them more easily propagated. Phony order or invoice emails that claim to need your immediate attention look just like the real thing.

Your first instinct is that something isn’t right, but the phrasing suggests you must check this out—right now!

Pause and take a breath first.

First, let’s check out the little details.

Before forwarding any email or clicking on any links or attachments that claim to be important, you need to vet that email. Before reacting, it is worth the extra effort to ensure it is not a hoax or a scam.

This tiny effort can prevent you from unknowingly installing malware or inadvertently providing payment or personal information you will regret later.

Don’t Click “Phishy” Links!

phishing: n
The practice of luring unsuspecting Internet users to a fake website by using authentic-looking email with the real organization’s logo, in an attempt to steal passwords, financial or personal information, or introduce a virus attack; the creation of a website replica for fooling unsuspecting Internet users into submitting personal or financial information or passwords.

These scammers aim to get you to click a link or call a phone number. Do not click on any links or attachments until you verify the sender. Even if the email looks legitimate, double-check whether the clickable links are valid by mousing over the links to “see” the domain name below.

No matter what the Subject: field states or the message implies. Look at the underlying email address. Mouse over the link, then look at the location bar in your lower window. Does it match what is displayed? In many cases, it won’t.

Hoaxsters have become pros at making emails appear to be from legitimate contacts or companies (UPS, Amazon, PayPal, Best Buy, antivirus software, financial institutions, etc.). They steal logos and images to make their emails look just like what you’d expect.

When you see where the link points, you can immediately determine whether it could be trouble. But even with that, hoaxsters are very clever at making the underlying URL look legit(ish), too.

Here’s How to Investigate the Underlying Link Code

Let’s use Amazon as an example:

In the cases above, the only credible domains are those in which “amazon” appears directly before the .com or .whatever. Noting “amazon” anywhere else is dubious at best.

When you see website URLs with the company name, don’t assume the domain is safe if it differs from what you usually see. If you have even the slightest doubt, do not click links; go directly to the website as you usually do.

The thing is, anyone can register a domain name. While you are not supposed to buy or use domains of other companies’ brands and trademarks, that doesn’t stop the bad guys. They’ll use them until they get caught.

What else should you look for in dubious links?

Even if you mouse over and see what looks like the usual URL, there could be a script tacked on that you can see in the code, causing you to go to a fake website. There was a time when you could check a domain’s legitimacy by looking up who owned it. However, due to privacy concerns, that information is now usually hidden.

When in doubt, go to the primary domain you usually use. In this example, go to amazon.com and log in to your account. Check your user dashboard on the legitimate site for any alerts or messages that require your attention. No alerts? No new orders? No outstanding payments due?

That email was most certainly a scam.

Dangerous Links

If you see a link that ends with the following — definitely don’t click on it:

If you don’t want to take the time to confirm an email’s legitimacy, just hit delete.

Hoax Vetting and Info Websites

A handful of websites used to serve as truth detectors and hoax exposers. They then lost their way or went offline. So it’s up to you to use common sense and vet links before clicking on link traps or forwarding them to others.

Be safe out there…