Email Threats: Phishing, Spoofing, Attachments and Oversharing

Email is still where many scams begin, and it is also where many people accidentally leak information themselves. Dr. Al-Doori's chapter covers six everyday email threats. This lesson keeps all six, updates them for today, and ends with a spot-the-phish exercise.

What you'll be able to do

Spot the warning signs of a phishing or spoofed email and choose the safe action, including when sending to a group.

• Recognise the signs of phishing and the three ways today's fake senders get past the checks you met in Lesson 2.2.
• Handle unexpected links, attachments and payment requests safely, including business email compromise.
• Send to groups without leaking anyone's information.

Why email attracts scammers

As the book explains, sending email costs almost nothing: reaching ten thousand people costs about the same as reaching ten. Even if only a tiny fraction respond, the scam pays. Spam is unwanted advertising mail. Phishing uses the same cheap reach to trick you into handing over passwords, money or access, or into opening something harmful.

The scale is large. The FBI's Internet Crime Complaint Center (IC3) recorded phishing and spoofing as the most-reported complaint type in 2025, with 191,561 complaints. The industry group APWG counted about 3.8 million phishing attacks in 2025. Messages are also getting more polished: the EU cybersecurity agency ENISA reported that more than 80% of the phishing emails it analysed between September 2024 and February 2025 used AI to some extent. So spelling mistakes are no longer a reliable clue.

Signs of phishing

Look for the levers from Lesson 3.1 more than for typos:

• An unexpected request, especially to log in, pay, confirm details or open a file.
• Pressure: urgency, a threat, a reward that expires, or a request for secrecy.
• A link or attachment you weren't expecting, even from someone you know.
• A sender address that doesn't match the organisation it claims to be.
• A change to a normal routine, such as new bank details or a new way of paying.

One sign is enough to stop and verify. A perfect-looking email with none of these signs can still be fake, which is why the habit of verifying sensitive requests matters more than any checklist.

Spoofing today: three ways fakes get through

Spoofing means making a message appear to come from someone you trust. The book's advice is timeless: a familiar name is never proof. What has changed is how spoofing works.

In Lesson 2.2 you met SPF, DKIM and DMARC. Where an organisation has set them up properly, forging its exact domain is increasingly blocked. DMARC is now an IETF standard (RFC 9989). So criminals use three other routes:

1. Display-name tricks. Your email app shows a name, such as "Quillmont Bank Security", that the sender typed. The actual address behind it may be anything. On a phone, tap the sender's name to reveal the full address.
2. Look-alike domains. The address uses a domain that resembles the real one, such as quillmontbank-alerts.test. Read it exactly as you learned in Lesson 2.3: find the registered domain and check it letter by letter. All domains ending in .test in this lesson are reserved for training and cannot be real public websites.
3. Real but hacked accounts. The message genuinely comes from your colleague's, supplier's or friend's account, because a criminal has taken it over. It passes every check, uses a familiar writing style and may even reply inside a real conversation.

The third route is why no technical check can replace your judgment. If a request is unusual, verify it through another channel, even when the sender is real.

Links and attachments

Links in phishing emails lead to fake login pages or harmful downloads. The safest choice is not to use a link from an unexpected message at all: go to the site yourself through a bookmark, a typed address or the official app. If you want to see where a link points, hover over it on a computer or press and hold on a phone to preview the address, then read the registered domain.

Attachments can carry malware that runs when you open them. Be cautious with any attachment you weren't expecting, even from people you know, since their account could be hacked. As the book advises, confirm with the sender through another channel before opening. Newer lures also use QR codes and fake "verify you are human" pages, which Lesson 3.3 covers.

Business email compromise

Business email compromise (BEC) is a targeted scam in which a criminal uses a hacked or look-alike business email account to redirect money. Typical requests: "Our bank details have changed, please pay this invoice to the new account", or "I need this transfer done today, I'm in a meeting". IC3 recorded about $3.05 billion in reported BEC losses in 2025.

The defence is simple and must be automatic: any change to payment details is confirmed by phone, using a number you already had on file, before any money moves. Never use the phone number in the email that announced the change.

Leaks you cause yourself

The book's last three threats are about what you send.

• Reply All can send a private remark to a whole group. Check the recipient list before you press send.
• Forwarding a thread also forwards everything below it, including earlier messages and everyone's addresses. Trim what the new reader doesn't need.
• CC versus BCC. Everyone in the CC (carbon copy) field can see every other recipient's address. When emailing a group of people who don't know each other, put their addresses in BCC (blind carbon copy) so no one's address is exposed to strangers or spammers.

If a phishing email reaches you, use your email app's "Report phishing" or "Report junk" option, or your organisation's reporting process, and then delete it.

Spot-the-phish exercise

All three messages are invented. Decide for each: phish, or probably genuine, and what you would do. Then check the model answers.

Message A. From: "Quillmont Bank" <security@quillmont-bank-alerts.test>. Subject: Unusual sign-in blocked. "We blocked a sign-in from a new device. If this wasn't you, secure your account within 24 hours using the button below."

Message B. From: your friend Omar, his usual address. No subject. "Hi! Look at these photos from the weekend!" with an attachment called photos.zip. Omar doesn't normally send attachments, and you didn't spend the weekend together.

Message C. From: noreply@tallowfield.test, your university's real domain. "Reminder: the library closes at 18:00 on Friday for maintenance." No links, no attachments, no request.

Real-World Example

Imagine: Priya works in the accounts team of a small company. An email arrives from the real address of a long-standing supplier, in the middle of a genuine thread about last month's order. It says the supplier has changed banks and attaches an updated invoice with new account details. Everything looks right, and the message passed every check, because the supplier's mailbox has been hacked.

Priya follows her team's rule. She calls the supplier using the number saved in the company's records, not the one in the email. The supplier knows nothing about a bank change. The payment would have gone straight to the criminal. This is business email compromise in its most common form.

From the Book to 2026

What the book teaches. Six email threats: eavesdropping (sniffing), spam and phishing, spoofing, malicious attachments, reply and forward leaks, and CC versus BCC exposure. Encryption defeats sniffing, skepticism defeats spoofing and phishing, and a glance at the recipient line prevents most sending mistakes.

Why it made sense. Every one of these threats is still real, and the habits remain good advice.

What has changed. Security guidance has evolved since the original text. Encrypted connections are now almost universal (Mozilla reported that only 2.4% of Firefox page loads still used unencrypted connections in early 2025), so phishing for passwords matters far more than sniffing them. Sender checks (SPF, DKIM and DMARC, now RFC 9989) increasingly block forgery of an exact domain. So look-alike domains, display-name tricks and hacked real accounts are the main danger, and business email compromise has become one of the costliest scams.

What to do now. Read the real address, not the display name; go to sites yourself instead of using links; confirm unexpected attachments and every payment change through another channel; use BCC for groups.

What Would You Do?

You are organising a residents' meeting and need to email 40 neighbours, most of whom don't know each other. A neighbour you've never met replies to your first message asking for "everyone's email addresses so I can share some useful local information". What do you do?

Knowledge Check

Key Takeaways

• Phishing is cheap, huge in scale and increasingly polished, so judge the request, not the spelling.
• Exact-domain forgery is increasingly blocked; display names, look-alike domains and hacked real accounts are today's main routes.
• Don't use links or open attachments from unexpected messages; go to the source yourself or verify another way.
• Confirm every change to payment details by phone on a number you already had (business email compromise).
• Check recipients before Reply All or Forward, and use BCC for groups of strangers.

Further Study

• IBM Technology — What is Phishing (optional, external). Its remarks on email spoofing predate today's sender checks, and you can skip its suggestion to change network settings.
• CISA — How to Avoid Phishing! (optional, one-minute recap)

Sources

• UK NCSC — Phishing: Spot and report scam emails, texts, websites and calls
• US FTC — How To Recognize and Avoid Phishing Scams
• IETF — RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
• FBI IC3 — 2025 IC3 Annual Report
• APWG — Phishing Activity Trends Report, Q4 2025
• ENISA — ENISA Threat Landscape 2025
• Mozilla — HTTPS-First in Firefox 136
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 7: Email Security