Recognizing Suspicious Emails

Cybercriminals are constantly changing their tactics, but most scam emails share the same goal: to get you to click a link, open an attachment, call a phone number, send money, or provide sensitive information.

Taking a few moments to recognize the warning signs can help protect both you and your organization.

Common Warning Signs

Be cautious if an email contains one or more of the following:

• An invoice, purchase confirmation or payment receipt for something you don't recognize.

• A notice that a subscription or service (such as Microsoft 365, antivirus, web hosting, or a domain name) is about to expire when you weren't expecting it.

• A request to renew or pay for a service you don't believe you have.

• A message claiming your account will be suspended, locked, or deleted unless you act immediately.

• A request to verify your password, Multi-Factor Authentication (MFA) code, banking information, or other sensitive details.

• Unexpected attachments or links.

• Unexpected QR codes asking you to sign in, verify your account, or make a payment.
• Unexpected Multi-Factor Authentication (MFA) prompts or verification codes that you did not request.
• Requests to change banking information, payment details, or direct deposit information without prior discussion.

• Requests to purchase gift cards, wire money, or make urgent payments.

• Pressure to act immediately or threats of serious consequences if you don't.

• Poor grammar, unusual wording, or formatting that doesn't seem like the sender.

• An email that simply "doesn't feel right," even if you know the sender.

Beware of Fake Purchase and Renewal Notices

One of today's most common scams involves fake purchase confirmations and renewal notices.

These emails may claim that:

• A large purchase has just been made using your account.

• Your antivirus or software subscription has automatically renewed.

• Your Microsoft 365, email, website, or domain name is about to expire.

• A payment has failed and requires immediate attention.

The goal is often to create panic so you'll react before thinking.

Many of these emails include a phone number and instruct you to call immediately to cancel the charge or renew your service.

Do not call the phone number provided in the email.

Instead, if you believe the message could be legitimate, contact the company using a phone number or website that you already know, or search for the company's official website yourself.

If an Email Looks Suspicious

If you're unsure whether an email is legitimate:

• Do not click links.

  • Before clicking any link, hover your mouse over it to see where it actually leads. If the destination looks different from what you expected or seems suspicious, do not click it.

• Do not open attachments.

  • Even if the email appears to come from someone you know, be cautious of unexpected attachments—especially if they ask you to enable editing, enable macros, or sign in to view the document.

• Do not reply to the email.

• Do not call any phone numbers listed in the email.

• Do not provide passwords, MFA codes, payment information, or personal details.

  • If you receive an MFA prompt or verification code that you did not initiate, deny or ignore the request. Someone may be attempting to access your account.

Instead:

• Visit the company's official website yourself by typing the address into your browser.

• Use contact information you already know or can independently verify.

• If the email appears to come from a coworker, client, supplier, or other trusted contact, do not reply to the suspicious email. Contact them using a known phone number, a previous email conversation, Microsoft Teams, or another trusted communication method to verify the request.

Even Emails from People You Know Can Be Fake

Cybercriminals sometimes compromise legitimate email accounts or impersonate people you know.

An email may appear to come from:

• Your manager

• A coworker

• A client

• A supplier

• Your accountant

• A family member

If the message asks you to do something unusual, urgent, confidential, or financially significant, verify the request through another trusted communication method before taking any action.

Never rely solely on replying to the suspicious email, as the response may go directly to the attacker.

Trust Your Instincts

If something feels unusual, stop and think before acting.

It's always better to spend a few minutes verifying a message than to spend hours recovering from a successful scam.

When in doubt, ask your IT provider before taking any action. We'd much rather investigate a legitimate email than help recover from a successful scam. 

Remember

When you receive a suspicious email:

• Stop and think.

• Don't panic.

• Don't click.

• Don't open attachments.

• Don't reply.

• Don't call the phone number in the email.

• Verify independently using trusted contact information.

• Ask your IT provider if you're unsure.

A few moments of caution can prevent significant financial loss, identity theft, or a security breach.

If you've been a victim of fraud and wish to file a report, or if you wish to obtain more tips regarding dealing with fraud, either call your local police department or call the Canadian Anti-Fraud Centre at 1-888-495-8501 or report a complaint using this form.

If you truly do have a computer problem, don’t call a random number appearing on your screen and don’t fall for any technician that calls you.  Find a local, reputable computer company that you can call with confidence, or actually stop in to speak with and feel at ease using their services.

Office Works

Your Technical Team - On Your Side

Call or Text: 519.863.6336  -  Email: support@officeworks.ca

Website: www.OfficeWorks.ca