Don’t believe everything you read

In a world where anyone can post anything online, it’s important to remember that not everything we read is accurate or trustworthy. The internet gives everyone a voice, but it doesn’t guarantee honesty, context, or credibility. Taking information at face value can lead to misunderstandings, so a little scepticism goes a long way.

Over the weekend we received the following approach via email.

“Hi there,
I noticed your team did a great job with setup recently. Do you offer ongoing support for software issues or troubleshooting?
Thanks,

smartyurl.com

domain must be plain text”

I have removed the purported sender’s name which appeared above the last line. At first glance, it would seem like a valid sales opportunity requiring an appropriate follow up. What possible harm could come from responding?

First red flag, “SmartyURL” is a tool used for creating shortened, tracked, and redirected links. Someone could easily send an email from this domain for phishing, marketing analytics, or malicious redirection. We can’t see the true source of the sender.

Next up, it was sent to an address we publish on our website, not one in daily use for correspondence. Had the sender been closer to the recent, “great job with setup” we had undertaken, he may have been privy to out regular contact emails. The question regarding ongoing support is answered without any great fuss from a visit to our website – the same visit which was used to procure the contact address to send to us – which means a genuine sender could have directed a more specific question had there been a requirement.

To my eye, this email approach is a classic social engineering phishing tactic designed to trick employees (especially those in IT, operations, or support roles) into establishing a connection with a scammer.

The overall picture doesn’t look right.

As I have written many times over the years, treat emails with a degree of scepticism until you have sufficient evidence to the contrary. In the absence of such evidence, err on the side of caution, query with colleagues and your trusted IT support for a clearer understanding.

We offer advice, support and simulated phishing email campaigns to help improve your awareness and resilience to the dangers of malicious email. For more information, please reach out to robert@vcisystems.co.uk or contact 0118 976 7111