Social Engineering Red Flags
FROM DATE
• I don’t recognize the sender’s email address as • Did I receive an email that I normally would
someone I ordinarily communicate with. get during regular business hours, but it
• This email is from someone outside my organization was sent at an unusual time like 3 a.m.?
and it’s not related to my job responsibilities.
• This email was sent from someone inside the
organization or from a customer, vendor, or partner
and is very unusual or out of character. SUBJECT
• Is the sender’s email address from a suspicious
domain (like micorsoft-support.com)? • Did I get an email with a subject line that is
irrelevant or does not match the message
• I don’t know the sender personally and they content?
were not vouched for by someone I trust.
• Is the email message a reply to something
• I don’t have a business relationship nor any past I never sent or requested?
communications with the sender.
• This is an unexpected or unusual email with an
embedded hyperlink or an attachment from
someone I haven’t communicated with recently.
ATTACHMENTS
TO • The sender included an email attachment that I was not expecting or that
makes no sense in relation to the email message. (This sender doesn’t
ordinarily send me this type of attachment.)
• I was cc’d on an email sent to one or more people, but I don’t
personally know the other people it was sent to. • I see an attachment with a possibly dangerous file type. The only file type
that is always safe to click on is a .txt file.
• I received an email that was also sent to an unusual mix of people.
For instance, it might be sent to a random group of people at my
organization whose last names start with the same letter, or a whole
list of unrelated addresses.
CONTENT
HYPERLINKS • Is the sender asking me to click on a link or open an attachment to avoid a negative
consequence or to gain something of value?
• I hover my mouse over a hyperlink that’s displayed in the email message, but • Is the email out of the ordinary, or does it have bad grammar or spelling errors?
the link-to address is for a different website. (This is a big red flag.) • Is the sender asking me to click a link or open up an attachment that seems odd or illogical?
• I received an email that only has long hyperlinks with no further information, • Do I have an uncomfortable gut feeling about the sender’s request to open an attachment
and the rest of the email is completely blank. or click a link?
• I received an email with a hyperlink that is a misspelling of a known web site. For • Is the email asking me to look at a compromising or embarrassing picture of myself or
instance, www.bankofarnerica.com — the “m” is really two characters — “r” and “n.” someone I know?
© 2017 KnowBe4, LLC. All rights reserved. Other product and company names mentioned
herein may be trademarks and/or registered trademarks of their respective companies.
