UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 4.1 Free with a free account
Deceptive Emails and Messages Designed to Trick You into Giving Away Sensitive Information
Ethics in Technology · Chapter 4: Manipulation, Surveillance, and the Laws That Govern Digital EavesdroppingSection 4.1 · lesson 13 of 11615 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: How Attackers Manipulate Human Psychology Instead of Breaking Through Technical Defenses →← How Social Networking Shapes Relationships, Mental Health, and Personal IdentityNext lesson: How Attackers Manipulate Human Psychology Instead of Breaking Through Technical Defenses →
In this lesson
Pause, inspect the request, and verify through an independent channel.
- Define phishing and 6 common forms
- Recognize pressure and message warning signs
- Read illustrative web addresses carefully
- Verify, report, and respond promptly
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,990 words). Read along, or search it.
Chapter 4
Recognizing Deceptive Emails and Messages
Phishing messages imitate trusted sources, trying to obtain information, money, or access through deception. The request may arrive by email, text, voicemail, or a live phone call. It often succeeds by making a familiar story feel urgent, before the recipient verifies the facts. This lesson examines six common forms, separating the targeted audience from the communication channel. We also identify pressure cues, and inspect the different parts of a suspicious message. Sender names, copied logos, and polished wording cannot establish that the request is genuine. Web addresses deserve careful attention, because a trusted name can appear in an unrelated destination. The most useful response is independent verification, using contact information outside the suspicious message. Reporting can protect other people. It gives providers or security teams information for their response. If exposure has already occurred, prompt account and financial action can reduce the resulting harm. Keep the sequence clear: pause, inspect, verify independently, and follow the appropriate reporting or recovery process.
Phishing
Impersonated Trust Can Open the Door
Phishing is fraud through an impersonated message, presented as coming from someone the recipient trusts. That source might appear to be a bank, employer, delivery company, or familiar person. One goal is credentials, such as a password that provides access to an important account. Another is financial information, including card details, personal identification numbers, or account security codes. A third is direct payment, through a false invoice, gift-card demand, or urgent transfer request. A fourth is device access, after the recipient opens harmful content or follows an unsafe instruction. Human trust is often central. Technical controls and software updates can already be in place. Phishing can also be combined with other weaknesses, rather than being entirely separate from technology. The FBI's two thousand twenty-five Internet Crime Complaint Center report placed phishing and spoofing first by complaint count. That is a finding about reported complaints, not a complete count of all incidents in society. The practical lesson is that strong systems still need reliable judgment, about requests received by people.
Psychological Triggers
Pressure Tries to Replace Deliberate Judgment
Urgency creates a short deadline, encouraging the recipient to skip a normal verification step. Fear adds a threatened loss, such as account closure, penalties, or supposed legal trouble. Authority makes the instruction appear to come from a manager, government agency, or support team. The request may also demand secrecy, discouraging the very conversation that could expose the deception. Reward offers an attractive prize, refund, or deal, drawing attention toward the promised benefit. Curiosity suggests a revealing file, salary information, or other material the person wants to see. Helpfulness appeals to concern for a friend, colleague, or someone apparently facing a difficult situation. These triggers can be combined. They can make an otherwise unusual request feel immediately compelling. Recognizing a trigger does not prove fraud, but gives a reason to pause and verify. Good spelling and attractive formatting do not remove that need, because careful deception can look professional. Focus on the request's logic, rather than judging authenticity by whether the message looks clumsy.
Common Forms
Separate Audience From Communication Channel
Bulk phishing sends a broadly similar message widely, relying on reach rather than detailed personal relevance. Spear phishing selects a person or team, using names, projects, or other familiar information. That relevance can make a request convincing, without proving the sender has legitimate authority. Whaling describes targeted phishing against senior executives, or other especially valuable targets. CEO fraud instead impersonates an executive, often directing another employee to approve an urgent payment. The terms are related, while the target and the impersonated role should not be confused. Clone phishing copies a familiar message, replacing a genuine link or attachment with deceptive content. Smishing uses text messages, including false parcel notices, toll demands, or bank alerts. Vishing uses phone calls or voicemail, relying on spoken persuasion rather than a written request. Caller identification can be spoofed. An apparently familiar voice does not establish the caller's identity. Channel, audience, and familiarity explain the form, while independent verification remains useful across all of them.
Historical Examples
Familiar Authority Can Be a Weak Point
The source uses two historical incidents, showing how apparently familiar authority can create serious consequences. In two thousand sixteen, aerospace supplier FACC reported roughly fifty million euros leaving through cyber fraud. Its reports described a fake-president incident. The financial accounting function was involved. The chief executive was later dismissed, as a further consequence described in the company's reporting. This is the amount reported at that time, rather than a statement about the current unrecovered balance. The example emphasizes payment checks, even when a request appears to come from the top of an organization. In July two thousand twenty, Twitter described phone spear phishing, directed at a small number of employees. Compromised access preceded misuse of high-profile accounts, including messages promoting a cryptocurrency scam. The company's account illustrates that convincing spoken contact, can mislead employees despite other system safeguards. Neither a senior title nor a familiar support story, substitutes for independent authentication of the request. Maintain payment and access procedures under pressure, because urgency is precisely when those checks matter.
Message Anatomy
Inspect the Whole Request, Not Just the Logo
Inspect the full sender address, rather than relying only on the displayed name. Check reply-to details as well, because the destination for a response may differ from the sender label. The subject can create urgency, while the greeting or story reveals unexpected or inconsistent details. Ask what action is demanded: opening, paying, signing in, replying, or disclosing information. A visible button can hide a different destination, so its wording alone does not identify the site. Unexpected attachments deserve scrutiny, especially programs, archives, forms, or requests to enable active content. A signature logo or official team name can be copied. It is not proof of identity. The source's fictional bank email threatens suspension within twenty-four hours, while demanding card information and a PIN. It also names a file as a statement, with a program extension following a document extension. That combination illustrates several warnings, rather than a checklist requiring every scam to look the same. Examine the complete request and context, instead of treating one reassuring visual detail as decisive.
Web Addresses
A Trusted Name Can Appear Inside an Untrusted Address
The source's fictional bank examples show why the position of a familiar name matters. In the first address, the bank's known domain is followed by the login path. In another, the bank name appears before account-verify dot net, which is the relevant domain in that example. The trusted-looking prefix does not transfer ownership, to the organization whose name appears inside it. A look-alike spelling replaces a letter with the digit one, producing a different destination. In the final example, the bank name appears after the slash, as part of another site's path. Those placements should not be confused, with the independently known official address. Domain boundaries can be more complicated than these examples, so avoid memorizing a universal last-two-words rule. HTTPS indicates protected transport. It does not prove the destination's honesty or ownership claim. When uncertain, close the message and use the official app, or a known address obtained independently. The purpose of inspecting the address is recognition, rather than visiting a suspicious destination to test it.
Red Flags
Several Clues Can Reinforce Each Other
Sender warnings include unknown addresses, mismatched names, changed reply destinations, or an unusual account for a known contact. Tone warnings include urgency, threatened loss, secrecy, and offers that seem unusually generous. Request warnings include passwords, PINs, security codes, or a sudden change in payment instructions. Demands for gift cards, wire transfers, or cryptocurrency can also require immediate independent checking. Link and file warnings include unexpected destinations, shortened addresses, double extensions, or requests to enable macros. Detail warnings include the wrong account, an order you do not have, or inconsistent formatting. Generic greetings and spelling mistakes can contribute, without every genuine message being perfect or every scam being careless. Unexpected callers may demand a code, become angry, or insist that you remain connected. No single sign proves every case. Carefully prepared phishing may show very few obvious mistakes. Personal details can be researched or copied, so familiarity does not establish legitimacy. Treat a suspicious combination as a reason to stop, and verify through a channel you independently trust.
Worked Text Example
A Small Redelivery Fee Can Hide a Larger Risk
The source's worked text claims a parcel is held, because its delivery address is incomplete. It demands a one dollar ninety-five redelivery fee, within twelve hours or the parcel will return. Expecting a parcel does not authenticate the notice, because that expectation can make the story persuasive. The deadline and threatened return add pressure, discouraging careful checking of the request. The stated destination is not the independently known official service, which adds another strong warning. A small fee can lead toward disclosure of valuable payment details, rather than being the main intended gain. Check through the postal service's official app or known site, using the genuine tracking information. The same separate-channel principle applies when someone requests a login or recovery code. Do not read such a code to an unsolicited caller, who may be attempting to access the account. Hang up and contact the organization independently, before following instructions about the supposed account problem. Pressure and a plausible story should never replace verification, of where the request actually originated.
Separate Channel
Verify Without Using the Suspicious Message’s Contacts
For an account alert, open the official app or known website yourself, and check for notices there. Do not use a suspicious message's link, phone number, or reply address to confirm its own claim. For a payment or bank-detail change, use a number from an existing directory or earlier contract. Follow the organization's approval controls, including a second approval where that procedure is required. For a friend requesting money, use a number or channel you already know belongs to that person. A real social account can be compromised, so the familiar account alone may not settle identity. For an unexpected caller, hang up and call the official number on your card or statement. An independently known official website can also supply an appropriate contact, when needed. Even without obvious red flags, verify requests involving money, passwords, or sensitive account information. If the organization confirms the request, complete the action through its official channel. If it does not, report the message and follow the relevant response process without continuing the interaction.
U.S. Reporting
Report Through the Appropriate Trusted Service
Reporting helps providers and security teams identify patterns, warn other recipients, and respond to ongoing deception. At work or school, use the approved reporting button, or the organization's IT and security instructions. For personal email, use the provider's phishing-reporting tool, and the Anti-Phishing Working Group's reporting address. That address is displayed on the slide, for use when following the reporting guidance. Suspicious texts can be forwarded to seven seven two six, where the mobile carrier supports that service. The digits correspond to the word spam, on a telephone keypad. United States scam attempts can be reported through the Federal Trade Commission's ReportFraud service. If money or financial details are exposed, contact the bank promptly and report through the FBI's Internet Crime Complaint Center. Impersonated companies can also be notified, through independently found official fraud or abuse contacts. These channels are specific to the United States, while other countries have their own reporting arrangements. Follow organizational instructions when handling work messages, rather than forwarding sensitive material through an unapproved process.
If You Already Acted
Prompt Action Matters More Than Embarrassment
If you already acted, stop the interaction and avoid entering any further information. If harmful content may have run, isolate the device and follow the appropriate security response instructions. Use a trusted device to secure affected accounts, rather than relying on a potentially compromised one. Change exposed passwords, and replace the same password wherever it was reused. Enable appropriate multifactor protection for important accounts, if that safeguard is not already active. Contact the bank immediately, if card information, account details, or a transfer are involved. The bank can advise on blocking, monitoring, or other available financial response steps. Tell the IT or security team promptly, when a work account or device may be affected. Review statements and account activity, for unfamiliar transactions or other signs of follow-on harm. Mistakes can happen to experienced people, and hiding the event can delay a useful response. Prompt, factual reporting matters more than embarrassment, because early action can limit the resulting damage.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Deceptive Emails and Messages Designed to Trick You into Giving Away Sensitive Information
What is the difference between phishing, spear phishing, and whaling?
What are smishing and vishing?
How can you tell if a link in an email is fake?
What should you do if you clicked a phishing link?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →