Email phishing and spoofing

What are phishing and spoofing?

Phishing is a fake message that tricks you into giving away a password, banking details or personal information, or into clicking a link that installs malware.
Spoofing is when the sender’s address is faked so a message looks as if it came from a company, a colleague or even yourself.

Urgency or threats: “your account will be closed today”, “confirm now”.
The sender address looks almost right but is slightly different (for example an extra letter or a different ending).
A link whose real address, shown when you hover over it, is not the company’s own website.
A request for your password, PIN or one-time code. Genuine companies do not ask for these by email.
Unexpected attachments, especially .zip, .html or .exe files, or an invoice you were not expecting.
Changed banking details on an invoice or payment request.
Poor spelling or an odd greeting such as “Dear user”.

Do not click the links or open the attachments.
Do not reply with any personal information.
If it claims to be from a company you deal with, go to their website yourself by typing the address, or phone a number you already know.
Delete the message, or forward it to support@afterwavetechs.co.za if it pretends to be us.
If you already clicked and entered a password, change it immediately, and change any other account that uses the same one. See What to do if your website or email is hacked.

Setting up SPF, DKIM and DMARC makes it much harder for criminals to send spoofed email that appears to come from your own domain. See Stop your emails landing in spam: SPF, DKIM and DMARC.