Scam of the Week: Spot Phishing Emails and Protect Your Workplace
Phishing emails are one of the most common and dangerous scams that businesses face today. In this week’s Scam of the Week, I’ll be sharing a real-life experience from my company, The Smith Investigation Agency Inc., and how one of my staff members, Kristine, identified a phishing email pretending to be from me. I’ll also offer practical tips and tricks on how to spot and avoid phishing emails to keep you and your workplace safe.
The Phishing Email Incident
On March 6, 2025, one of my staff members, Kristine, received an email that seemed to be from me, the owner of the company. The subject line read “quick task”—a nondescript, vague phrase meant to get the recipient’s attention. The email came from an unusual email address: infox234@wp.pl instead of my official company email address, which you cannot see if you do not click on. Below is the content of the email:
Begin forwarded message:
From: Whitney Smith infox234@wp.pl
Subject: quick task
Date: March 6, 2025 at 12:07:43 PM EST
To: Kristine kristine@smithinvestigationagency.com
Hi Kristine,
I’m planning to surprise some of the staff with gifts, Your confidentiality will be appreciated. Let me know if you are available to get the purchase done.
Regards,
Whitney Smith.
At first glance, it may seem like a harmless email. But Kristine, who is sharp and vigilant, immediately called me, knowing something was off. While the email was addressed to her and appeared to come from me, there were several red flags that made it obvious that this was a phishing attempt.
What Made Kristine Spot the Scam?
Kristine knew me well and recognized the email as a scam for several reasons:
-
The Tone and Language Used: I always start my emails with “Good morning” or “Good afternoon.” I don’t just send informal, short messages that begin with a simple “Hi” or “Hey.” The tone of the email felt off because it didn’t reflect how I normally communicate with my team.
-
The Email Signature: I have a very clear and consistent email signature that includes “Kind Regards, Whitney Joy Smith,” along with my official contact information. This email lacked both my full name and the signature, which is one of the first things I noticed when Kristine pointed out the email.
-
The Unusual Request: The email claimed I was “planning to surprise some of the staff with gifts” and asked for Kristine’s help to get the purchase done. I’ve never discussed my plans with staff in advance. My usual practice is to plan things without informing others until the task is ready to be carried out.
-
The Email Address: The sender’s email address, infox234@wp.pl, wasn’t even remotely close to my official company email address, which ends in @smithinvestigationagency.com. Scammers often use email addresses that look like they could be legitimate at first glance, but a closer look will reveal the differences.
Tips and Tricks: How to Spot Phishing Emails
Phishing scams like this one are designed to trick you into revealing sensitive information or clicking on dangerous links. They rely on urgency, familiarity, and vague requests to manipulate recipients into taking action without thinking. Below are the key things to look for to spot a phishing email:
Check the Sender’s Email Address
Always verify the sender’s email address. Official emails from your colleagues or business partners should come from trusted domains (e.g., @yourcompany.com). If the email address seems odd or unfamiliar, be suspicious. Scammers often create email addresses that look similar to the real ones but with small variations (e.g., info@yourcompanyname.com vs. inf0@yourcompanyname.com).
Look for Typos and Grammatical Errors
Legitimate business emails should be professionally written. Phishing emails often contain spelling and grammar mistakes. In the example above, while the email itself wasn’t riddled with mistakes, the lack of a professional email signature and the casual, abrupt tone were clues that something was wrong.
Examine the Content of the Message
Phishing emails often contain urgent or alarming language designed to provoke an immediate response. If an email asks for sensitive information, urgent action, or requests you to click on a suspicious link, stop and think. In my case, the request for Kristine to help purchase gifts was highly unusual and didn’t align with how I conduct business.
Check for Unusual Requests
Scammers may try to trick you into sending money, buying gift cards, or providing sensitive business information. In this phishing attempt, the scammer tried to create a false sense of urgency and confidentiality. A request to “get the purchase done” without any context was definitely a red flag.
Do Not Click on Suspicious Links
If the email contains links, hover your mouse over them to see where they lead. If the URL looks strange or doesn’t match the official domain of the company or person who supposedly sent the email, don’t click on it. Instead, go directly to the website by typing the URL into your browser.
Verify with the Sender Before Responding
If you receive an email that seems out of the ordinary, especially from someone you know, don’t respond right away. Contact the sender through a known, trusted communication channel (e.g., phone or direct message) to confirm whether they actually sent the email. This can save you from falling victim to a scam.
How to Educate Your Staff and Create a Safer Work Environment
It’s essential to create a culture of awareness around phishing and other online scams at your workplace. Here’s how you can help your team stay safe:
-
Regularly Educate Your Team on Phishing Risks
Hold training sessions and send out reminders about phishing and other scams. Make sure your staff knows how to recognize suspicious emails and what to do if they receive one. Encourage them to be vigilant and question any email that seems out of the ordinary. -
Implement a Two-Step Verification Process
For sensitive actions like financial transactions or any other business-critical decision, encourage your team to use a two-step verification process. This can involve verifying emails or phone calls with another method of communication. -
Create a Clear Email Policy
Develop and share a clear email policy with your staff. Outline the tone, format, and signature requirements for all work-related emails. This will help your team spot deviations from the norm, such as missing signatures or unusual language, which are common signs of phishing. -
Encourage Reporting Suspicious Emails
Ensure that all staff members know how to report suspicious emails or other phishing attempts. It’s important that everyone feels comfortable reaching out for clarification if they’re unsure about an email they’ve received. Having a system in place for reporting phishing will help protect the entire company from falling victim to scams. -
Regular Security Checks and Audits
Regularly audit your security protocols to ensure that your systems are protected against phishing attempts. This can include email filtering systems, firewalls, and other cybersecurity measures that help prevent malicious content from reaching your team in the first place.
Final Thoughts
Phishing scams are one of the most common threats to businesses today, but with the right education and awareness, you and your team can stay protected. Kristine’s quick thinking helped us avoid falling victim to this scam, but it’s important that we all remain vigilant when it comes to spotting and reporting suspicious activity. By understanding how phishing works and taking proactive steps to protect your workplace, you can help ensure your business remains safe from cybercriminals.
Remember: if something doesn’t feel right, trust your instincts, verify the information, and don’t engage with a suspicious email until you’re sure it’s legitimate. Stay alert, stay secure!
Learn More About Scams on the Go!
For more tips, tricks, and insights on how to spot scams and protect your business, check out my YouTube channel, where I post regular videos on the latest scam trends and how to avoid falling victim. Subscribe and stay up-to-date on how to keep yourself and your workplace safe from cyber threats.
Watch My Scam Awareness Videos on YouTube like this video on Sextortion scams.
