Email Security Best Practices
1: Multi Factor Authentication (MFA)
If you do not already have MFA enabled on your email account, you should do this immediately. If you already have Microsoft Authenticator on your Mobile Device and see your email address as an account in there, you should be all set.
MFA prevents unauthorized access to your email by providing an extra level of security should a hacker manage to get your email password. MFA requires your interaction after a proper login attempt by asking you to interact with your cell phone which would keep a hacker from getting into your account without your knowledge.
One MAJOR concern with MFA is that ANY time you are challenged to interact with the Authenticator App, you need to stop and take a pause. Are you intentionally logging into your account for good reason? Are you 100% sure the reason you are logging into your account is for a legitimate purpose? #2 in this guide details a situation where people are tricked regularly, hopefully it will help you to know that just because MFA is being used, you can be fooled into giving scammers access to your account
2: Avoid Phishing Scams
You have likely received messages with “Secure Attachments” and others asking you to change your account password because it is expiring. The majority of these are scams. Rule of thumb is that even if an email looks legitimate, you should assume it is not and if you need to access the data, you should contact the sender, not through email in case their system is compromised, and you’ll only be talking to the hacker.
Hackers will regularly provide email links or attachments that will prompt you to login to your Microsoft Account in order to retrieve the message. These are almost always just an attempt to get you to give your email address and password to them.
If you receive a message with a “secure attachment” or some other reason that asks you to log into your account online, you need to STOP. Ask yourself if the email you are reading is something you expected to get or requested? Or is it just an email from a trusted source/friend/business contact that was unsolicited but still seems fine because everything looks correct? The senders email could be correct. The email could be a response to a previous email of yours. But is it logical that you are getting a response requiring you to login to get an encrypted reply. Err on the side of caution in that someone has hacked into the sender’s account and is trying to fool you. Call the sender to ask them what the message is before proceeding.
Unless you are 100% sure it’s safe, assume it is not. The common scam here is that you will provide your email address and password and then be challenged with an Authenticator code only to be told after going through these steps that there is a problem with the account and to try later OR even more common, that the message was recalled by the sender. This is to make you figure everything is normal when in reality, the hackers now have access to your email and in a way you won’t realize they are inside your mailbox. Even if you are a trusting individual in your day to day life, try to be extremely pessimistic with email because this is where most of today’s hacks are coming from.
3: Wire Transfers and ACH Requests
NEVER make ANY changes to your payment process without verbal communication with the party you are paying. If you receive communications via email on how to make a payment via wire or ACH, CALL the sender and discuss the particulars to keep yourself safe. Hackers are preying on victims daily by sending new bank information when a payment is coming because they are monitoring emails in and out of compromised accounts. By doing so, they can see when a payment is requested and immediately follow up with new payment information to try to get the money intended for the hacked user.
4: Don’t click on links in emails
While they seem easy and simple and convenient, links within emails are by and large dangerous. Even if they don’t bring you to a scam website, they can be tracking your clicking and use that information to further try to scam you. If you get an email from your bank with a
link, avoid the link and open your browser and visit the bank website. This one simple change in email behavior can have a HUGE impact on your overall security.
If you hover over an email link, you will often see that the link contains bogus information, ie. A link to retrieve a secure email from your bank has a website: https://bhyioio.localme.ru
A link that isn’t showing, https://bankofamerica.com, https://chase.com, etc. is definitely nothing you want to take a chance on.
5: Pay attention to the actual sender of emails you receive
Quite often emails that are scams will present as coming from a name you know but if you look at the email address associated with the person, it is illogical. Here is a real-life example of an email sent to accounting@tcs3.com recently, purportedly from Adam Egdall:
-----Original Message-----
From: Adam Egdall <pathomporn@port09.c0.th>
Sent: Tuesday, August 13, 2024 10:55 AM
To: Accounting <accounting@tcs3.com>
Subject: RE: Membership Bill - INV106518
