Misuse of data

Often, even the most convincing phishing emails reveal themselves by their email address. It's useful to know that most email services and apps show the full name of the sender, and scammers can do that too. The sender can fill in whatever they want. Therefore, always click through to the actual email address.

Malicious email addresses can often be recognized in two ways. The easiest case is a striking email address like mail@x23emm.net or belastingdienst@gmail.com. Attempts are also often made to imitate an existing address. However, it is possible that a phishing email comes from an seemingly legitimate address or even from your own email address.

The scammers behind a phishing email want to extract information or make you click through to a fake website. Therefore, do not just click on links in messages and do not provide personal information via email.

If you do want to click on a link, check the link first. On PCs, you can hover the mouse pointer over a link to view the address. On smartphones and tablets, you can do this by pressing and holding the link. If the address looks suspicious, for example with long sequences of characters, then definitely do not click through.

• Pay attention to language use
Phishing emails are often sloppily written and contain typos, translation errors, spacing errors, or unusual language. The design of the email is also often not as polished as that of real emails from, for example, banks and the government.

However, there are also very convincing and indistinguishable phishing emails in circulation, which may even have your own name on them. Here too, you should look at more than one characteristic.


• Do not download and open strange files
If you receive a file from an unknown sender, do not just download it. The file may contain malware that can be installed when opened. On a Windows device, do not just open files ending in .exe, and on a Mac, do not open files ending in .dmg. These are installation files.

Also, do not open files ending in .js, .ink, .wsf, .scr, or .jar. These contain scripts that are automatically executed when clicked.


• Check if the email is a phishing email
On the site fraudehelpdesk.nl keeps track of all known phishing emails. With that overview, you can check if a suspicious email is indeed a phishing email.