Data-Guard 365 lists the five flags that an email is not legitimate:
- Is the body of the email addressed to you? Just like a letter addressed to "Dear Friend" or a robocall that doesn't mention your name, a non-personalized email is a sign of a campaign to target vulnerable users.
- Were you expecting the email? Normally advertisers and organizations send their emails on regular day and time schedules. An unexpected email from an unfamiliar source is a danger signal.
- Are there obvious spelling or grammatical errors? The sender may be a fraudster whose native language is not English.
- Was it sent or received at an irregular time? It may be from a foreign time zone.
- Is there a sense of urgency? Don't send money or provide information without checking.
An email with one or more of these warning signs should be reported as a potential attack on your system.