Tips on How to Spot a Malicious Email

“I have installed antivirus software and I’m still receiving scam emails!”  Sounds familiar doesn't it?

Email inboxes are still the most effective tool for cyber criminals to steal sensitive data and access computer networks. Most companies use antivirus software expecting to stop new threats or advanced malicious-email attacks. Unfortunately, this is not always successful.

Scam emails are a real concern because they are often used to deliver new ‘fast-break’ or ‘zero-day’ attacks. Endpoint antivirus software can identify known threats and assist in stopping threats delivered via other means such as flash drives or USB but zero-day malware received in scam emails is likely to remain undetected by any antivirus software.

Cyber criminals consistently adapt and develop their exploitation tools at a fast pace. It can take hours or even days for antivirus vendors to identify new threats and organize software updates. Further, delays then occur while their customers download and install those updates. During the updating process, unprotected computers are susceptible to attack.

Because sophisticated cybercrime networks are familiar with traditional antivirus solutions, they will examine and improve their attacks to ensure success.

In one specific email scam that had been intercepted, scammers used over 160 variations of the attack to stay ahead of antivirus updates.     

Companies that rely on antivirus protection alone put their data-security at serious risk. Cyber criminals know that humans are a cybersecurity loophole. Their objective is to get malware emails into a company’s inboxes, because people are much easier to trick than machines. If just one person inside a company opens a scam email and clicks on a link, they can infect the whole company’s computer network.

Have a look at the screenshot below. This is an actual scam email that was intercepted earlier this year.

The ‘update payment’ link in this message goes to a phishing website with bogus Netflix branding.

Looks genuine, doesn’t it?

Unfortunately, the sole-purpose of this web-page is to collect the personal details and credit card data of victims who were fooled into clicking the email link. A email message like this is unlikely to be detected by antivirus software.

If your company’s inboxes aren’t protected, messages like these are probably being received by your staff and it’s a matter of time before someone has a momentary lapse of judgement and clicks on the wrong link.

Here's our tips on how to spot a malicious email -

  1. Use your Outlook Reading pane to look at the email.
  2. Check the email address it is being sent from.  The displayed name may be legitimate but what does the actual email address say?
  3. Look at the link in the email.  Is it related to the company that is sending the email?
  4. Look at the language in the email.  Is it generic?  Does it say dear customer?
  5. Examine the attachment name.  Is it generic?  Is it something you recognise?
  6. If in doubt call your IT department/partner or delete it.

If you'd like any further information, assistance with your cyber security or you don't know where to start please call us on  1300 478 738 or email us at

About the Author

Geoff Stewart is a highly experienced and skilled Technology Director at Surety IT. His knowledge is based on years of industry experience having created customised, stable, well performing systems both for multi-national companies in the UK and Australia and Surety IT customers.

Surety IT can help you create the right system to enhance your business, ensuring you know how it is right for you and how to use it. We will tailor a solution to suit your needs with leading systems, local support and more, building your vision for a more flexible and capable business.

Call us today on 1300 478 738 or email to discuss your requirements.