SC-Wiki24

Audience: End users and admins.
Purpose: Help you decide if an email is legitimate in under 60 seconds.
Updated: 2025

• Are you expecting anything right now?
• Are you expecting anything from these people/company?
• If the email mentions domains/hosting/billing: ask, *who is my real provider?* If it’s not the sender, it’s likely phishing.
• If it asks you to click, hover your mouse over the button/link—your mail app shows the actual URL.
• Want more certainty? In Outlook (desktop): File → Properties → Internet headers. Check the true From/Return-Path and authentication results (SPF/DKIM/DMARC). They must match the brand you expect.
• Geo note: Country/TLD is only a weak signal—attackers use any country and many generic TLDs. Treat geo as extra-scrutiny, not a blocker.

Stop now if any are true: asks for passwords/2FA, urgent payment/bank-detail changes, gift cards/crypto, remote access, or you didn’t expect it.

1) Sender

1. Name matches someone you know or a real department.
2. Email address matches the real domain (no look-alikes like `rnicrosoft.com`).
3. Reply-To is the same as From.

2) Context

1. Am I expecting anything right now?
2. Am I expecting anything from these people/company?
3. You were expecting this email (invoice, file, delivery, password reset).
4. You actually have an account/relationship with the company named.

3) Links

1. Hover shows the same brand domain (e.g., `https://accounts.google.com/…`).
2. No link shorteners (bit.ly, tinyurl) or random strings.
3. No QR codes you’re being pushed to scan.

4) Attachments

1. You expected an attachment from this sender.
2. Avoid risky types: `.exe .js .scr .bat .ps1 .vbs .iso .img .zip .html .htm`
3. Office/PDF files do not ask to “Enable Content/Macros”.

5) Language & look

1. Uses your correct name and specific details you recognise.
2. No odd grammar, threats, or too-good-to-be-true offers.
3. Branding looks right (logos not blurry; footer/legal normal).

6) Client warnings

1. No “External sender” or “Failed authentication (SPF/DKIM/DMARC)” banners.
2. Not flagged by your mail client as suspicious.

7) Verify safely (don’t use email links)

1. Open the website/app yourself from a saved bookmark or by typing the address.
2. Call/message the sender on a known number/channel to confirm.
3. For payments/bank changes: do a voice check with your contact.

8) If suspicious

1. Don’t click, don’t reply, don’t forward (except to IT/security).
2. Use Report phishing in your mail app, then delete.
3. If you clicked or entered details: change password, enable MFA, inform IT/bank, run a malware scan.
4. Optional: forward to reportphishing@apwg.org.

Notes:

*.yu* (Yugoslavia) = retired.
*.mf* (Saint Martin, FR) = reserved/not generally in operation.
Reminder: ccTLD/country is a weak indicator. Always prioritise SPF/DKIM/DMARC, link/attachment analysis, sender reputation, and business context.