The Phishing Email That Looked Real
Maria works in the finance department of a mid-sized company. She receives an email that appears to come from the CEO, marked as high importance, with the subject 'Urgent Wire Transfer Needed'. The email asks her to transfer $15,000 to a new supplier account immediately, stating that the CEO is in a meeting and cannot be reached. The email address is [email protected], which matches the company's domain, but the display name is 'CEO John Smith'. The email includes a PDF attachment with invoice details and a link to a fake login page that mimics the company's portal, asking her to sign in to approve the transfer. Maria is suspicious but wants to act quickly to avoid upsetting the CEO. She forwards the email to her colleague to ask for advice.
1. Identify at least three red flags in this email that suggest it is a phishing attempt.
Read the worked answer
- Urgency and secrecy: The email demands immediate action and implies the CEO is unavailable, creating pressure to bypass normal procedures.
- Unusual request: A wire transfer to a new supplier is not a standard request via email, especially without prior notice or verification.
- Link to fake login page: The email includes a link to a page mimicking the company portal, a common tactic to steal credentials.
- Attachment: The PDF attachment may contain malware or further phishing instructions.
- Sender address spoofing: Although the email address appears correct, it could be spoofed; check the actual sender address and email headers.
- Display name mismatch: The display name 'CEO John Smith' might not match the actual email account if the account was compromised.
2. What should Maria do next, and what should she not do?
Read the worked answer
Should do:
- Do not click any links or open attachments; instead, report the email to the IT/security team immediately using the company's phishing report button or procedure.
- Verify the request through a separate channel: Call the CEO directly using a known phone number (not from the email) to confirm if the request is legitimate.
- Follow company policy: If the transfer is legitimate, it should go through normal approval processes, not email.
- Warn colleagues: Inform others in finance about the phishing attempt.
Should not do:
- Do not reply to the email or forward it to colleagues (as she did) because it may spread the phishing attempt; instead, report it.
- Do not transfer money without verification.
- Do not enter credentials on the linked page.