Email Scams: How to Spot, Avoid and Report Them

Email scams or phishing emails are fraudulent activities carried out via email, where scammers aim to trick recipients into submitting personal information or clicking on malicious links. These email scams pose as legitimate communications from banks, retailers, social media platforms – any trusted entity – with one goal: to lure you into revealing sensitive information, sending money, or installing malware on your devices.

An estimated 3.4 billion emails a day are sent by cybercriminals, designed to look like they come from trusted senders.

Email scams account for 1.2% of global email traffic, and each one has the potential to lead to financial ruin, identity theft, or a cyber attack.

In this rapidly evolving battleground, knowledge is your strongest defense. Staying informed about the latest scam tactics and equipping yourself with the right tools can mean the difference between falling victim to these schemes and emerging unscathed.

Signs of a Scam Email

Most scam emails lead recipients to phishing websites, tricking them into revealing sensitive information like passwords, credit card numbers, and bank accounts or accessing malicious links and harmful attachments.

Spotting the telltale signs of a scam email can protect you and others from falling victim.

Here's how to detect fake emails:

1. Incorrect sender's address. Carefully check the sender's email address. Phishing emails often have an address that doesn't match the company or organization they're pretending to be from.

Other common fake emails include those claiming to be a "missed package delivery" from a service like FedEx but coming from an address such as "[email protected]" or emails with strange attachments supposedly from a trusted source like "[email protected]." These fake emails often have slightly altered or unusual addresses to trick recipients.

Always verify the sender's address by visiting the official website of the company or organization. If you're unsure, contact the company directly using information from their official site, not from the email.

2. Spelling and grammar mistakes clearly indicate a phishing email. Legitimate businesses take great care to ensure their emails are error-free, whereas phishers are likelier to make these mistakes. For instance, an email from "PayaPal" with typos is a red flag. However, it's important to note that with the rise of AI chatting and writing bots, grammatical mistakes are becoming less common.

However, it's important to note that with the rise of AI chatting and writing bots, grammatical mistakes in fake emails are becoming less common. Sophisticated phishing attempts might have polished language, but they can still contain subtle errors or awkward phrasing that give them away. Always read emails carefully; if anything seems off, it's better to be cautious.

Additionally, phishing emails might use odd formatting or inconsistent fonts and colors, which can be another sign of a scam. Legitimate companies maintain a consistent and professional appearance in their communications.

3. Urgent or threatening language. Phishing emails frequently use language that attempts to create a sense of urgency or threat to pressure you into taking action quickly. Phrases like "Your account will be suspended if you don't update your details immediately" are common phishing tactics.

Phrases like "Your account will be suspended if you don't update your details immediately" or "Your bank account will be frozen within 24 hours if you do not verify your identity" are common phishing tactics.

To protect yourself, always take a moment to pause and think before responding to urgent requests. Legitimate companies typically offer various ways to verify urgent messages and will not pressure you into immediate action.

4. Requests for personal information: Be wary of any email that asks you to provide sensitive information like passwords, credit card numbers, or social security numbers. Reputable companies will never ask for this information via email.

On the other hand, fraudulent emails may prompt you to click a link to verify your account information or update your billing details. Even if the email appears to be authentic, always go directly to the company's official website instead of clicking on any provided links.

Furthermore, reputable companies typically provide secure methods for updating personal information, such as encrypted websites or secure customer service channels. If an email requests personal information without these security measures, it is likely a scam.

5. Suspicious links or attachments: Hover your mouse over any links or attachments in the email to see if the URLs or file names look suspicious or out of place.

For example, a link that claims to be from "yourbank.com" but points to "yourbank.website.com" is a clear red flag.

Fake emails often include attachments labeled as invoices, receipts, or important documents. These attachments can contain malware or viruses. Always be cautious of unsolicited attachments, even if they appear to come from a trusted source.

To protect yourself, avoid clicking on links or downloading attachments from suspicious emails. Instead, visit the website directly by typing the URL into your browser. Use antivirus software to scan any unexpected attachments before opening them.

Types of Email Scams (With Examples)

All scam emails aim to steal personal information like usernames, passwords, and credit card details. They usually urge you to click a link that leads to a fake website designed to steal your login credentials.

Verify Your Identity Scam

These fake emails claim to be from reputable businesses, such as your bank, email provider, or social media platform. They state that your account is on hold or compromised and needs verification. The email includes a link to a counterfeit website where you are asked to enter sensitive information, which is then harvested by scammers.

If you click the link, you will be redirected to a fake website that will steal your account information.

2. Inheritance email scams

This phishing scheme has been around for such a long time that it has become a classic. It involves emails claiming you have inherited a large sum of money from a distant relative or unknown benefactor. The message often includes a compelling story to make it seem legitimate. To claim the inheritance, you are asked to provide personal data, such as your full name, address, and banking details. The scammer's goal is to steal your identity or solicit advance fees under the pretense of processing your inheritance.

3. Lottery Scam Emails

These emails inform you that you have won a significant amount of money in a lottery you never entered. They ask for personal details, including your name, address, and bank information, to supposedly transfer the prize money. Alternatively, they may request a fee to process your winnings. In reality, there is no prize, and the information provided is used for identity theft.

4. Tech Support Scam Emails

These emails claim to be from a tech support team, like Microsoft or Apple, alerting you to a serious issue with your computer or account. The message urges immediate action, such as calling a provided number or clicking a link. Scammers use fear tactics to pressure you into giving remote access to your computer, allowing them to steal personal information or install malware.

5. The fake invoice or Payment Scam Emails

These emails come with fake invoices or payment requests, targeting businesses or individuals who manage finances. The emails create a sense of urgency, demanding payment for goods or services you never ordered or received. Often, they include an attachment or link to view the invoice, which can install malware or lead to a phishing site.

6. Email Account Upgrade Scam

The email tells you that your email account will expire unless you take immediate action. It appears to come from trusted email providers like Microsoft, Google, or your company's IT department. The message includes a link to a fake login page where you are prompted to enter your email credentials, which are then stolen.

7. Unusual Activity, Issues, Locked Account Scam

These emails often use logos and branding from services like PayPal, eBay, or your bank or social media platforms like Instagram, Facebook, or LinkedIn. They claim there is suspicious activity on your account or that it has been locked for security reasons. The email urges you to click a link to resolve the issue, leading to a fake website that looks authentic, where you enter your login details that are then stolen.

8. Tax Refund Email Scam

These emails impersonate government agencies, such as the IRS or local tax authorities, promising a tax refund. They ask for personal and financial information, including bank details, to process the refund. The link in the email redirects you to a phishing website that looks legitimate but is designed to steal your information.

Related: How to spot tax scammers

8. Fake HR Scams

These emails appear to come from your company's HR department, asking you to update or verify employee data. Scammers may use LinkedIn to find your workplace and make the email seem more credible. The email includes a link to a fake site where you enter sensitive information, posing a risk to both individuals and the organization.

9. Package Scam

This scam involves fake emails from delivery services like FedEx, UPS, or DHL. The email claims there was an issue with your package delivery and asks you to update your address or payment information. Clicking the link leads to a phishing site designed to steal your information.

10. Incorrect Billing Information Notices

These emails claim that your billing information needs updating for popular services like Netflix, Amazon, or Spotify. They warn that your account will be suspended if you don't act quickly. The email includes a link to a fake login page where any information entered is captured by scammers.

11. Dropbox Phishing Emails

These emails impersonate Dropbox, asking you to click a link to review shared documents. The email may appear to come from someone you know, making it seem more trustworthy. The fake Dropbox page prompts you to download a harmful file or enter your login details, which are then stolen.

12. Fake App Purchase Prompts. These emails mimic communications from app stores like Apple's App Store or Google Play, claiming you've made a purchase. The email includes a receipt or a "successful payment" subject line. Since you likely didn't download the app, you might suspect your account was hacked. The email contains links or attachments that lead to phishing attempts or install harmful software on your device.

How to protect yourself from email scammers

Email scams that were once easy to spot have become increasingly difficult to detect with the naked eye as spammers employ the latest technologies to craft their impersonation emails.

Fortunately, you can fight fire with fire by harnessing cutting-edge solutions specifically designed to help you stay one step ahead of these nefarious actors.

Here are two examples:

1. Email Protection: This solution for Outlook and Gmail requires a one-time setup. After that, all incoming emails are automatically scanned before reaching your inbox, regardless of the platform you use—be it a computer, laptop, phone, or tablet. Email Protection intelligently displays labels in your inbox, clearly identifying safe and potentially unsafe emails and empowering you to make informed decisions. Additionally, it provides comprehensive statistics and threat detection details for each protected email account, allowing you to stay vigilant and proactive.

Bitdefender Email Protection is available now at no additional cost for new and existing Bitdefender Premium Security, Premium Security Plus, Ultimate Security, and Ultimate Security Plus plan holders.

2. Scamio is our next-generation, powerful scam-detection chatbot that quickly verifies the legitimacy of emails, links, QR codes, messages, and SMSs before they can harm you, your family, or your finances.

You can start chatting with Scamio right now, as it is completely free, and you can access it on any device or operating system via your web browser or through Facebook Messenger.

What to do when receiving scam emails

If you receive an email you suspect is a phishing attempt, here's what to do and not do with it.

1. Don't engage with it: Do not click on any links, open attachments, or reply to the message.

2. Forward the email to the company or organization being impersonated: Many companies have dedicated email addresses or reporting systems for phishing attempts.

3. Report it to your email provider: Most email providers have options to report phishing emails directly from your inbox.

4. Report it to government agencies: Report phishing attempts to agencies like the Federal Trade Commission (FTC).

By learning to identify email scams, reporting them promptly using and sharing Scamio with others, you can help protect yourself and dear ones from these cyber threats.

I Clicked on a Link in a Scam Email, What Can I Do?

If you've clicked on a link in a scam email, don't panic. There are several steps you can take to mitigate the damage and protect yourself:

Run a Security Scan. Use your computer's antivirus or anti-malware software to perform a full system scan. This will help detect and remove any malicious software that might have been installed.

Change Your Passwords. If you entered your credentials on a fake website, change your passwords immediately. Start with the account that was targeted, and then change passwords for other accounts, especially if you use the same password for multiple sites.

Enable Two-Factor Authentication (2FA). For added security, enable two-factor authentication on your accounts. This requires a second form of verification (like a text message or app notification) in addition to your password.

Monitor Your Accounts. Keep a close eye on your bank accounts, credit cards, and other important accounts for any unusual activity. If you notice anything suspicious, report it to your bank or the relevant institution immediately.

Report the Scam. Report the phishing attempt to the relevant authorities. In the U.S., you can forward the scam email to the Federal Trade Commission (FTC) at [email protected]. You can also report it to your email provider and the impersonated company.

FAQs

What happens if a scammer has your email address?

If a scammer has your email address, they can attempt various malicious activities. You may start receiving phishing emails, spam, or malware-laden messages. Scammers might also use your email address to send fraudulent messages to your contacts, trying to gain sensitive information or financial details. In some cases, your email address could be used in identity theft schemes or to create fake accounts on various platforms.

What are 3 signs that a suspicious email may be a phishing email?

1. Unusual Sender Address: If the sender's email address is misspelled, uses a domain that slightly differs from a legitimate one, or appears overly generic like “[email protected]”, it’s a red flag.

2. Urgent or Threatening Language: Phishing emails often create a sense of urgency or fear. Phrases like "Immediate action required" or threats of account suspension are common tactics used to prompt quick, unthinking responses.

3. Suspicious Links or Attachments: Hover over links without clicking to check if the URL matches the destination you expect. Beware of attachments you weren’t expecting or those with unusual file extensions (e.g., .exe, .zip, .scr).

How do email scams happen?

Email scams typically happen through phishing, where scammers send emails designed to trick recipients into divulging personal information or clicking on malicious links. These emails often appear to come from trusted sources, such as banks or popular services. Scammers can also use email spoofing to make their messages seem legitimate. Once a recipient falls for the scam, they might unknowingly provide sensitive data, download malware, or be redirected to fake websites that steal their information.

How do hackers send emails from my email address?

Hackers can send emails from your email address using a technique called email spoofing. This involves forging the sender address on an email to make it appear as if it’s coming from a trusted source. They do this by manipulating email headers and exploiting vulnerabilities in email protocols. In some cases, hackers may also gain direct access to your email account through phishing attacks or other methods, allowing them to send emails directly from your inbox without your knowledge. To prevent this, use strong, unique passwords and enable two-factor authentication (2FA) on your email account.