Imagine this scenario

You receive an email from the MD of your company; nothing particularly unusual, just an invoice from a new supplier that needs to be paid. The subject line doesn’t look unusual and the email’s written in the usual style of your manager. You open the attachment to see the invoice.  Next minute you’ve managed to open a link to some malware that’s infected your computer, or you’ve paid a sum to a supplier that doesn’t exist.

You may have missed the fake domain name being used by the sender.

Scammers use fake domain names to lull their victims into a false sense of security.

The supposed “sender” may not always be from within your organisation. Sometimes cyber criminals send emails purporting to be from a reputable company, with Microsoft, Apple and various high street banks frequently being impersonated.

The human eye is easily tricked into seeing what it “wants” or is used to seeing and scammers use this to their advantage. For instance when the correct domain is @companydomain.com, the spam sender’s slightly different address of name@companydomains.com may go unnoticed.  Commonly mis-spelled words such as accommodation vs accomodation can also be leveraged to the advantage of those with malicious intent.

Spammers rely on the fact that not everyone will double check the sender address, especially if it looks like it’s coming from a sender that you regularly get emails from.

You may think “l wouldn’t be silly enough to fall for that!”. But did you notice that the capital “i” (for indigo) in the last sentence was actually a lowercase “l” (for Lima)? It can be as simple yet sophisticated as that. Two “v”s side by side will look like a “w” when viewed in the small From section of your email client. “rn” can easily be mistaken for “m” as can a zero for a capital “o”.

If you’re not expecting an attachment (or ideally, even if you are), check and double check the sender’s address before clicking any links or opening any attachments. If in doubt, copy the email address into a Word document and increase the font size, this will help you to identify individual characters that aren’t as they seem. Delete the email without opening the attachment if you discover anything untoward.

If needs be, verify the sender by another means if you think that the email is suspect. Pick up the phone to your manager and check that the invoice is legitimate.