11 Phishing Scams You Need To Look Out For

Email phishing scams have become the most common method scammers use to access title agencies and their clients’ accounts to commit wire fraud. It’s vital that you be aware of the common phishing techniques used so that you can identify suspicious activity and stop fraudsters in their tracks. 

Email phishing happens when a scammer pretends to be a figure of authority or someone you know to steal your personal information, such as social security numbers, credit card information, and bank account details. The scam starts when you receive an email from outside your place of employment. The email seems convincing and can be hard to recognize as a scam. It might look like it’s from a reputable company that you interact with: your title company, your bank or your company’s IT department.

The email will request that you perform a task or follow a link to access sensitive data. When the link is followed, it typically takes you to a fake “login screen" that is designed to steal your credentials. The scammers now have access to your account and will proceed to take advantage of the access, including using your credit card and bank account details or committing wire fraud.  

‍

Table of Contents

• Email phishing scam examples
  • 1. An Email From the IT Department
  • 2. Urgent Request
  • 3. Unsolicited Invite to an Event
  • 4. Report of Unusual Activity
  • 5. Malicious Email Attachment
  • 6. Macros Within Documents
  • 7. Using a Fake Email Address
  • 8. Ramshackle Web Design
  • 9. Social Media Exploits
  • 10. Out of Place Messages
  • 11. Targeting CEO’s for Wire Fraud
• Email phishing scams: key takeaways

Email phishing scams examples

Here are some concrete examples of what a phishing attack actually looks like and how it can be prevented.

1: An email from the IT department

This type of email looks like it’s coming from your IT department claiming that an upcoming outage or system update will result in your account being deleted if you don’t click the link. An email like this can seem legitimate and routine.  

However, any IT department that has access to your system will never ask you to follow an external link. Updates will occur automatically or the IT team will update the system remotely.

2: Urgent request

Many email phishing scams make the message seem as urgent as possible. The scammer may say that your account will be deleted in under 24 hours if you don't enter your details or click on the link. This is known as “threat motivation,” the fear that by not taking action there will be undesirable outcomes. 

In these scenarios, remember that no IT company would delete accounts because of an update or an external request. 

3: Unsolicited invite to an event

This email is an example of “reward motivation,” something that scammers use when trying to gain access to accounts to commit wire fraud. You might receive an email invitation to an event or notification that you won an award. The email comes out of the blue and is usually from someone outside your network. You will then be directed to a fake login screen that is designed to steal your credentials.

One way to recognize these scams is to notice what’s missing from the email: There will usually be no link to a website, information about the organization hosting, or details about the event or award. 

4: Report of unusual activity

Paypal will always have your full name, not address you by your email. Plus look at the email address above. Source

This type of phishing occurs when you get an email from what appears to be an authorized source saying that someone has attempted to hack your account. It will often claim that someone has gotten access to your details.

‍

Following this alarming news, the hacker may ask you to perform a couple tasks:

1. Change your username and password: The hacker will send a link to a fake login screen. When you click on it, log in, and fill out the form, you simultaneously give your old password along with your new one.

2. Request a call: The hacker will ask for your phone number to discuss system vulnerabilities. The call will seem to go to a “real” call center, answered by a computer or a real person working for the scammers.

5: Malicious email attachment

Attachments are one of the most common methods used in email phishing scams. Scammers will hide an HTML form in the file that looks like a real login page. When you click on the malicious attachment, you are prompted to enter your login credentials to view it. 

Be wary of attachments that come from unknown email addresses, emails that urge you to open the attachment immediately, and emails with suspicious contents (such as typos or other errors). Another sign is if the URL links to a location on a hard drive and not an actual site. 

Also check the file type. Files that end in .exe will install malware on your computer when downloaded. Look out for file names that end in “m” as they contain macros (such as .docm, pptm, and .xlsm). Lastly, don’t click on attachments that end in .jar, .cpl, .com, .bat, .msi, .js, and, .wsf. 

6: Macros within documents

Another common email phishing scam is including a malicious macro within a document. A macro allows you to automate certain tasks and adds functionality to documents, such as forms and reports. 

With these types of phishing emails, if you already have macros activated, you’ll be asked to download and open an attachment, and you’ll be automatically directed to a fake login screen that steals your credentials. If you don’t have macros turned on, you will be asked to enable it.  

7: Using a fake email address

In this example, you can see that the email address looks suspicious. If an email is from a professional company, it will have a professional address, not @gmail.com or @hotmail.com, or in this case, @elyciotalen.nl. 

To protect yourself, always double-check the sender’s email address and never click on links coming from an unknown source. It’s better to take the time to verify if the email address is legitimate than to open a potentially fraudulent email. 

8: Ramshackle web design

A ramshackle website that does not look like a professional page for a national bank. (Source)

Any legitimate businesses will have a design for their websites that looks visually appealing and well designed. Scammers, on the other hand, often choose a design that lacks integrity and looks unprofessional. Watch for branded company websites that just don’t seem right, are not responsive on mobile, don’t change size and shape when you scale the browser window, or use plain HTML.

9: Social media exploits

‍

Scammers have found a way to exploit social media platforms, like Facebook In these types of scams, an attachment is sent through Facebook Messenger by the scammer pretending to be someone you know. Once the attachment is clicked on, you’re redirected to a spoofed YouTube page instructing you to install a Chrome extension. You are then sent to a fake login screen designed to steal your credentials.

Be wary of messages that come out of the blue, appear to be from people you haven’t spoken to in a long time, and seem strange (like this one that contains only one SVG file). 

10: Out of place messages

‍

Scammers have also started using similar tactics on LinkedIn, such as a bank email phishing scam (pictured above). By going through LinkedIn, the scammer can ascertain a lot of information about you, such as what company you work for, what your role is, and where you live. This allows them to personalize their scam to make it as accurate and convincing as possible.

Though they can seem convincing, banks, title agencies, and other reputable organizations will never contact you about your account or ask for financial information via LinkedIn. 

11: Targeting CEOs for wire fraud

This email phishing scam is directed at CEOs. If you're a title agent, it’s especially important that you are aware of this scam, as your likelihood of being targeted is higher. Fraudsters know you handle vast sums of money and are trusted by your clients. Scammers will leverage your brand’s reputation to target clients and do a lot of damage. 

To learn more about this type of scam, also known as business email compromise, check out this blog post. 

Email phishing scams: key takeaways

After looking through these examples, we can draw three key takeaways:

1. Scammers will try to make phishing emails look as convincing as possible. They will use credible institutions' logos, impersonate people you know, and build a sense of urgency. 
2. Though these emails can look real, there are signs you can look out for, including fake email addresses, requests that go against company procedure, poor website design, and requests for login credentials when none should be required. 
3. When in doubt, don’t click on links or open attachments. It’s always worth the time to double check that an email is legitimate and not from a scammer.    

CertifID offers four different types of mandatory security validation before each and every wire transfer. When you use CertifID, you can feel safe that your business and your client’s money is protected. For more on how CertifID can protect your business from wire fraud, schedule a demo.

‍