Well, not really, but it was the most convincing piece of phishing that I had ever run it to. Usually, I just review the contents of my Junk folder to update myself on the latest techniques all the scumbags use to try to separate me from my data, credentials, and ultimately my money. Lo and behold I received an email to myself from myself. And what was more interesting is that it came from my iCloud account. Apple forces us all to lock down our iCloud accounts tighter than Fort Knox, so this was interesting.
The email went on with the usual threats if I didn't pay $1783.29 in bitcoin to some obscure wallet. I of course checked my sent folder and there was no copy of this email, so it was unlikely sent from my account. Then I looked over the message headers and found that the originating email was from a Russian domain.
Yes, it was just spoofing, but it was a decent attempt, and if I weren't adept at this garbage, then I probably would have freaked out. But the good news is that it's easy to spot these sorts of things. Here is how to do it.
Is it in Junk? In the case of the email mentioned above, my Junk folder caught it, so it was appropriately categorized. This should be clue number one if you get one of these... and you will.
Check Your Sent Messages If the supposed message looks to be from you, check your sent messages. If you don't see it in there, then that is a good sign. If you do, then your email account is compromised and you need to change your password and take the other necessary steps to secure it.
View Message Headers When an email moves through the internet it is stamped with all types of information. You can view this info in Apple Mail on the Mac by choosing the message, then go up to the View drop-down and select Message -> All Headers. It may look like the stuff from Algebra 3, but here you can see where the message originated from, if it was tagged as suspicious, and all types of detail about how it made its way to your inbox.
The bottom line is if you get one of these spoofing emails, do not panic and start by following the steps above. Most of the time it is simple phishing, but if the bad guys did get into your email, at least you followed the process to confirm that fact and locked it down. |