Email Links & Attachments — Red Flags

Attackers study how money already moves in your life or workplace: who sends invoices, which email threads look normal, and when deadlines create pressure. They then insert a believable payment-change instruction into that flow. The malware payload is optional — the goal is a human-approved transfer to an account the criminal controls. You do not need to work in a Fortune 500 finance team to be a target. Freelancers, students paying rent to a "landlord," families settling shared bills, and small shops paying suppliers all follow the same fragile pattern: trust the last email in the thread.

Domain lookalikes: display name says "Aisha — Acme Supplies," but the real address is [email protected] or acrne.com (r/n swap) instead of acme.com. Humans read the friendly name; mail clients show the truth only if you expand the header. Reply-to tricks: the visible From may be spoofed or close enough, while Reply-To silently routes your answer to an attacker inbox. You think you are continuing with your vendor; you are coaching the thief. Compromised real mailboxes: sometimes the vendor's mailbox is already taken over. The domain is correct, the thread history is real, and only the payment details changed. That is why "the email looks authentic" is not enough — money-change instructions need a second channel using a phone number you already trust from before the request.

# BEFORE changing ANY payment destination
TRIGGER = new bank account / wallet ID / wire path / "buy gift cards" / "keep this quiet"

1) STOP — do not update accounting systems yet
2) EXPAND sender:
   - Full email address (not display name)
   - Domain spelling vs known vendor domain
   - Reply-To header if visible (desktop: show original / headers)
3) COMPARE:
   - Does urgency + secrecy appear together?
   - Did banking details change without a prior expected notice?
4) VERIFY OUT-OF-BAND:
   - Call/video using a number from your OLD contract, official website you typed, or prior invoices
   - Do NOT call numbers provided only inside the suspect message
   - Ask a challenge only the real party knows (invoice #, last payment date)
5) DOCUMENT:
   - Who confirmed, date/time, and what details were approved
6) ONLY THEN update payment records

# PERSONAL / FAMILY VERSION
Rent, tuition, shared bills, "boss needs gift cards":
Same rule — voice-confirm with a known contact path before sending money.

# IF YOU ALREADY SENT FUNDS
1) Contact your bank/payment app fraud team immediately
2) Notify the real vendor/payee
3) Preserve the email headers/raw message for investigators
4) Rotate passwords on any mailbox that might be involved

# ETHICAL PRACTICE
Use only your own mail and sample headers from accounts you own.

Boring emails can move real money — your second channel stops that. Next — Safe Online Banking & Shopping — harden the apps and checkout paths where those payments actually clear.