The term "phishing" is a combination of the English words "password" and "fishing." It refers to the targeted "fishing" for access credentials, typically via email.

In most cases, the goal is to get the recipient to click on a link that leads to a fake website, where they are prompted to enter their login credentials. These fraudulent emails and websites are often designed to look almost identical to the genuine ones.

Below, you will find several characteristics and tips to help you more easily identify phishing emails.

Behind a seemingly legitimate sender name, there may be a forged sender address.

When you send an email, it is transmitted via SMTP (Simple Mail Transfer Protocol), the standard protocol for email. This protocol originated at a time when the Internet was a small, closed circle consisting only of universities and government agencies. Consequently, no security or authentication mechanisms were built into it.

A potential attacker deliberately exploits vulnerabilities in SMTP to send you an email that appears legitimate. For instance, they might include the following parameters in the email header:

If, for example, you use Outlook, only "internex GmbH" will be displayed as the sender. In reality, behind this arbitrarily chosen name lies the attacker's email address: "[email protected]".

Of course, there are other tactics for impersonating a sender.

For example, an attacker might use a sender domain that is similar to the legitimate one and difficult to distinguish from it:

None of the 3 example domains are our domain, internex.at. Even if you were to check the email address, you might not even notice the typos in the domain name.

With hyperlinks, it is possible to specify both a display text and an underlying destination address.

This allows legitimate entities, for example, to embed a link behind a specific word:

However, this also allows potential attackers to make a dangerous link appear legitimate:

It appears as though the link leads to Google, but in reality, you are redirected to our customer portal because a different address is embedded in the background.

When in doubt, never click on links in emails. Instead, open the relevant page yourself in your browser.

Attackers use email attachments to install malicious software on your computer, often under highly convincing pretexts (such as invoices, job applications, etc.).

These emails frequently create a sense of urgency, pressuring you to act rashly and open the attachment.

Particularly dangerous file extensions:

Constructs such as "document_pdf.exe" are also frequently used. The attacker is counting on you having hidden file extensions in your file manager, which could lead you to mistakenly believe the file is a harmless document (.pdf).

Artificial time pressure is one of the most psychologically effective methods for inducing you to act without careful consideration.

People often make poorer decisions when under stress. If you feel compelled to act immediately, there is no time to critically evaluate an email or verify its details.

Attackers use this tactic deliberately to trick you into disclosing data or clicking on malicious links.

To exert pressure on you, a fictitious scenario is often concocted to trigger panic. For example, an attacker might inform you via email, for instance ...

The intent behind this fearmongering is to block your ability to think logically.

In an email, an attacker will often pose as a trusted individual or entity, such as an IT staff member, a friend or acquaintance, a company, a government agency, or a bank. They deliberately leverage the authority associated with these entities to prompt you to act without careful consideration.

Attackers try to make their messages appear as convincing as possible, yet they often make typical mistakes in the process.

Since an attacker typically sends out mass emails to thousands or millions of people simultaneously, a personal salutation is often missing.

Typical impersonal salutations include the following:

An attacker often does not even know to whom the recipient address belongs.

In the age of AI, it is becoming increasingly difficult to identify phishing emails based on linguistic flaws. Spelling and grammatical errors are no longer a reliable warning sign for phishing attempts.

Attackers use AI software to translate emails into the target language, incorporating standard business phrasing.

Reputable banks, government agencies, or companies will never ask for sensitive data—such as passwords, PINs, or banking details—via email.

Transmitting such information by email is not only unprofessional but also poses significant security risks, as emails are not encrypted by default. During transit from you to the recipient, the communication can be intercepted and read by third parties.