Senior Tech Tip: How To Spot Spam and Phishing Emails

by Russ Alman, WVSAC Communications Director

There are lots of ways to communicate over the internet — social media like Facebook, instant messaging services like Messenger, virtual phone services like WhatsApp — but the gold standard for online communication, particularly with people over age 50, is still email.

While the public internet didn’t exist until 1993, the first email was sent way back in 1971 by inventor Ray Tomlinson. Ironically, the first unsolicited email (spam) was sent in 1978, still at least a decade before most people had access to email.

Another tidbit of history: the term “spam” was adopted for unsolicited email as a result of the infamous luncheon meat being used as part of a Monty Python Flying Circus comedy sketch. The word was so annoying in the sketch that it resonated with early email adopters.

Even as recently as 15 years ago, spam was considered a cardinal sin of the internet and your internet provider would cancel your service if you were caught doing it. Obviously, standards have evolved.

Spam, by definition, is unsolicited email. If you willingly signed up for email updates from an organization, that is not spam. And while it’s a gray area, it’s generally not considered spam if you receive email updates from an organization with which you have a previous relationship. That’s often defined as someone you’ve purchased goods or services from, but could also include any form of expressed interest. Old-timers online would likely disagree with this, but as I said before, standards have evolved — or devolved, depending on how you feel about it.

If you no longer want to receive emails from an organization from which you gave permission, you can opt out of future messages. Usually there is a link at the bottom of promotional emails that says unsubscribe. When you click the link, you’ll typically be sent to a web page in your internet browser asking you to confirm your decision.

In addition, some email platforms now can intelligently decide if an email is part of a subscription. In Gmail, for example, you will see an unsubscribe link at the top of emails. In many cases, clicking this link will unsubscribe you from that email list with no further steps. However, on occasion, clicking this link will open an opt-out screen in your browser.

Suspicious emails oftentimes provide clues that they are not legitimate. See how many you can find in this actual email that I received recently.

Phishing emails, on the other hand, are a specific type of spam designed to lure you into providing personal information that internet thieves can use to try and steal your money, identity and more. These emails will try and bait you into clicking on an included link or button and will then typically open a website that will request personal identifying information like bank account numbers, social security numbers and birthdays.

So how do you identify when messages are spam or phishing? Here are some key elements to look for:

Who was the message sent from? The email address that the message is being sent from should match the organization sending it. Look at the email address in the example on this page. “notificationservices.org” does not have anything to do with Capital One. (They also wrote the name as “Capitalone,” not “Capital One.”)
Does the message address you personally? Emails sent to “Dear User” or  other generic terms are suspicious. The example on this page passes this test, but fails in others.

Does the content seem “off” in any way? Read through the example on this page carefully. You’ll find typos, comma splices and other poor grammar. Since phishing emails often come from malefactors outside of the U.S., broken or poor English is a red flag.

In Gmail and Outlook, there are options to mark unwanted email as spam or phishing. Here are the options as they appear in Gmail on a computer.

Do the target URLs of links and buttons match the sender? Many email applications will show you the full target URL of a link or button when you hover your pointer over them. You can see in the example that the “Review Your Account” button does not link to Capital One.

​Pay attention to your email application. Email apps like Gmail and Outlook are getting better at identifying potentially harmful emails and will give you an alert, as well as preventing elements like images from appearing.

Since it is generally easy to unsubscribe from legitimate email updates you no longer want, you may be tempted to do the same with spam and phishing emails. However, I strongly urge you not to do this. The rule of thumb is that if you are not sure who sent you an email, do not respond or interact with it in any way. Instead, mark it as spam in your email application. Once you identify a message as spam, your email system will learn from your selection and subsequent emails from that source should end up in your spam folder. Spam messages are then typically deleted automatically after 30 days.

In Gmail and Outlook, there are also options to flag email as “phishing.” This will take it a step further and provide feedback to Google and Microsoft respectively so that they can block these malicious messages for everyone.

It takes some practice and persistence, but if you follow these guidelines for dealing with unwanted emails, you can greatly reduce the clutter in your inbox and protect yourself against online theft.