"Wall chart" for identifying spam/phishing

Forums › Off topic › "Wall chart" for identifying spam/phishing

1 | 2

sir1963

3265 posts

Uber Geek

Subscriber

#3153906 31-Oct-2023 09:53

gehenna:

Probably a good starting point is to assume no communication you receive is legitimate, and work your way up from there.

I actually won a prize worth 10K in a draw that I was put into just because I bought something from them.
It took me over a week of tracking where the email came from, where the web site was, etc etc etc before I came to the realisation it was legit.

I am always amused by the new paper articles where people who were ripped on on Facebook etc think their story will stop others.
No it wont, they are living proof of that, these scams and their stories have floated about for over 10 years, they learned nothing from them.

NEVER trust a spammer with your time, money, or health.

sir1963

3265 posts

Uber Geek

Subscriber

#3153915 31-Oct-2023 10:02

Eva888: Another one to watch out for that I received purportedly from Google, very legit looking telling me my storage was full and to click the link for a one time offer of X$. I checked the address url and sure enough it was a fake.

It made my heart drop when first opened and thinking damn, maybe I should take the great deal offered. I can imagine many would have fallen for it.

ANY unwanted email [spam] that tries o make you scared or panicked is a scam

"Your bank account has been halted..."

"One time offer ..."

"We have pictures of you nude..."

Then there are the greed scams

" U.N scam refund system..."

"Make money fast ..."

Emotional scams

"Russian ladies looking for love..."

"Child cancer patient..."

"You have inherited..."

cazique

8 posts

Wannabe Geek

#3153928 31-Oct-2023 10:34

The emails that are confusing my elderly friends/relatives are the ones with a shade of plausibility, e.g. fake Paypal/Microsoft/parcel-forwarding emails. They think these might be true because they do have Paypal/Microsoft accounts or are expecting parcels to be delivered. (I don't think they'd be naive enough to fall for a Nigerian banking scam, however!) I emphasise to them that genuine Paypal emails will always address you by name, whereas a fake Paypal email will not, etc.

alasta

6707 posts

Uber Geek

Trusted

Subscriber

#3153931 31-Oct-2023 10:47

My mother recently purchased something online from a vendor who uses Paypal as their payment gateway. She subsequently received a legitimate T&C update email from Paypal and suspected it was a scam email.

Tech companies really need to be more smart about how they manage their communications. In the above example, my mother doesn't understand how e-commerce works so did not perceive herself to be a customer of Paypal. Now that she has seen a 'strange' email that turned out to be legitimate she will probably be more complacent going forward. It's muddying the waters.

cazique

8 posts

Wannabe Geek

#3153985 31-Oct-2023 12:41

ANglEAUT:

cazique: ... I've found a few such images online but I don't think they're very good, frankly. I'm trying to find a simple chart that emphasises warning signs like: ...

Take your pick

👍👍👍 Stanford University
👍 Digital Guardian
FTC.gov
Tessian
National Cyber Security Centre
😄 iStock Photo

Thank for the suggestions, but I think those are all TLDR/too complicated for older people who are not very computer-savvy.

frankv

5680 posts

Uber Geek

Lifetime subscriber

#3154006 31-Oct-2023 14:22

cazique:

I'm trying to educate a few older friends and relatives how to recognise spam/phishing emails, but I fear they are not getting the message. I'm trying to find a simple chart that emphasises warning signs like:

Many years ago (I can't find it nowadays. :( ) I did a simple web page with a bunch of tick boxes, each with a mouse-over explanation of why it's a risk factor. It then calculated the overall risk of a scam, and compared it to the likelihood of some real-life event (e.g. hitting a hole-in-one (1 in 12000 for an average player https://entertainment.howstuffworks.com/sports/golf/basics/what-are-odds-hole-in-one.htm), being struck by lightning, being hit by a meteorite (1 in 184 million), winning a lottery) to give a perspective of the risk.

However, it included things like

Do you think it might be a scam? Risk factor = 75% -- most of the time, if you think it's a scam, you're right
Asks for money = 90%
Some-one you don't know = 75%
Asks for payment via Western Union or gift cards = 90%
Involves Nigeria, Cote d'Ivoire, Eastern Europe = 75%
Bad English in what should be a professional document = 50%
Pressures you to act immediately = 50%
Offers you a large amount of money = 90%
Won't give you an actual phone number = 90%
Tells you to keep it a secret = 50%
Involves an illegal act (e.g. claiming to be a relative of a dead engineer or money laundering) = 95%
Email address at Yahoo/Gmail/Other free provider = 50%
Is it in your spam folder = 99%

The maths is pretty simple... subtract each ticked risk factor from 1 (or 100% if you like), then multiply them together.

So some-one you don't know (75%) from Nigeria (75%) offers you a large some of money (90%) but asks for money first (90%) by Western Union (90%)

= .25 x .25 x .1 x .1 x .1

= .0000625 (0.00625%) chance that it's legit or 99.994% chance that it's a scam

= 1 in 16,000, so you're more likely to hit a hole-in-one on your next round of golf (unless you're a below average golfer ;) ). Or, if you have 16,000 similar emails in your inbox, it's likely that one (or more!) of them is legit.

For the purists, this calculation isn't totally correct, because the risk factors aren't completely independent (e.g. a disproportionate number of people in Nigeria may use Gmail and/or Western Union), but it's near enough. The actual risk values don't matter very much, it's the cumulative effect of several risk factors that quickly make it astronomically unlikely to be genuine. So I was quite conservative about the values I gave to each risk factor (e.g. I don't really think that 10% of people on the Internet actually give away large sums of money, maybe one in a million :D ).

LurkingKiwi

20 posts

Geek

#3154425 1-Nov-2023 14:15

Any URL with ipfs. in it is 99.99% a spam. Most people don't know what IPFS is (I didn't), but it's an anonymous de-centralised file-storage system - ideal for spammy pages and apps.

The links have a gateway node such as ipfs.io and a garbled file reference.

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

Kim587

129 posts

Master Geek

#3154429 1-Nov-2023 14:56

Are sites like this helpful for you? https://www.ownyouronline.govt.nz/personal/scam-check/email/

I'd say trying to scare you into doing something immediately, and using re: in the subject line to make it look like its continuing an existing conversation, are two tactics I've seen a lot lately.

1 | 2