A Suspicious Sign-In Alert
Tomas receives an email that appears to come from his email provider. It says: 'Unusual sign-in from Kyiv detected. If this was not you, verify your account within 24 hours or it will be suspended.' The greeting reads 'Dear Valued Customer'. The link text says 'Verify now' but hovering over it shows a domain ending in .top, not the provider's domain. The email has the provider's logo. There is a countdown timer image. Tomas did, in fact, travel recently, though not to Kyiv. He is worried and about to click.
1. Identify the phishing indicators in this email and explain which single one is most decisive.
Read the worked answer
Indicators present:
- Generic greeting ('Dear Valued Customer') rather than his name.
- Mismatched link destination - visible text says one thing, the actual URL points to an unrelated
.topdomain. - Artificial urgency and threat - 24-hour deadline and account suspension.
- Countdown timer image - a pressure device, not a real security feature.
- Logo used as a trust signal - logos are trivially copied and prove nothing.
- Unexpected event - he has no reason to expect a Kyiv sign-in.
Most decisive: the mismatched link destination. Urgency and logos can appear in genuine mail, but a real provider will not direct you to a domain it does not own. That single fact settles it.
2. Tomas is unsure because he really did travel recently. Explain how to verify the alert safely without using the email, and what to do if the alert turns out to be genuine.
Read the worked answer
Safe verification: never use the link or any contact details in the email. Instead, open a new browser window and navigate to the provider's service by typing the known address yourself, or use the provider's official app. Check the account's recent activity/security page there. If a real alert exists, it will be shown inside the account.
If it turns out to be genuine:
- Change the password from that verified session.
- Sign out of all other sessions/devices.
- Enable two-factor authentication.
- Review account recovery details for changes you did not make.
Either way: report the suspicious email to the provider (most offer a phishing report address) and delete it. Do not forward it to colleagues as a live link.
3. Suppose Tomas had already clicked and entered his password before noticing. What would change about his response, and why?
Read the worked answer
The situation becomes a credential compromise, not just a suspicious email, so the response escalates:
- Assume the password is known to the attacker. Change it immediately from a device he trusts, not from any page reached via the email.
- Change it everywhere it was reused - password reuse turns one leak into many.
- End all active sessions so the attacker's session is invalidated, not just future logins.
- Enable two-factor authentication, which limits damage from a password alone.
- Check for changes the attacker may have made: forwarding rules, recovery email/phone, linked accounts, sent items.
- Report it to the provider and, if work-related, to his IT/security team promptly - speed matters more than certainty here.