UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 13.2 Free with a free account
How Email Has Become One of the Primary Delivery Channels for Scams and Attacks
Ethics in Technology · Chapter 13: Digital Espionage, Online Threats, and the Science of EncryptionSection 13.2 · lesson 79 of 11612 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: The Security Risks Hidden Inside Instant Messaging Platforms and Chat Applications →← The Modern Cyber Threat LandscapeNext lesson: The Security Risks Hidden Inside Instant Messaging Platforms and Chat Applications →
In this lesson
Sender claims, persuasive requests, and harmful content require complementary defenses.
- Explain email’s reach, routine trust, and limits of visible sender information.
- Distinguish spoofing, look-alike domains, and business email compromise.
- Recognize attachment, link, and unsolicited bulk-email risks.
- Explain SPF, DKIM, DMARC, filtering, and independent verification.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,471 words). Read along, or search it.
Chapter 13
Email as a Delivery Channel
Email carries ordinary work requests and many attempts at deception. The same channel can deliver invoices, manager messages, scams, or harmful content. We will explain why its reach and routine trust make it attractive to attackers. A displayed sender name or From address is not standalone proof of identity. We will distinguish spoofing from look-alike domains and compromised real accounts. Next, we will examine business email compromise and its targeted requests. Malicious attachments, deceptive links, and unsolicited bulk messages create different risks. Finally, we will explain SPF, DKIM, and DMARC. These standards check domain-related claims, while content filtering examines other evidence. Neither authentication nor filtering independently proves that a payment or disclosure is authorized. Complementary defenses combine technical checks, careful judgment, independent verification, and established reporting procedures.
Why Email Works
Routine Communication Gives Deception a Familiar Setting
Email can reach many people with little sending effort. That scale helps explain its continued use in deceptive campaigns. It also carries routine work that recipients expect to see. Invoices, delivery notices, manager requests, and account messages can all appear plausible. A fraudulent message can imitate those familiar formats. Core email transport does not by itself authenticate the human named in a message. Modern authentication and filtering add important defenses. Their deployment, configuration, and results vary between services. The visible sender information remains a claim to assess. A believable invoice or password-reset message is not the same as independently verified authority. Confirm sensitive actions through established processes rather than let a familiar appearance replace approval or authentication.
Sender Impersonation
Forgery, Similar Domains, and Account Takeover Differ
Email spoofing forges sender-related header information. The aim is making a message appear to use another trusted identity or address. A look-alike domain is different. The attacker uses a separate domain with a small visual difference. A substituted character or extra letter may be easy to miss. Display-name deception emphasizes a trusted name beside a different address. A mail app may make that name more prominent than the full address. Account takeover presents another risk: a genuine mailbox can be used without authorization. Inspecting the complete address helps identify some deception, but it is not sufficient for every case. Authentication can limit exact-domain forgery without eliminating similar domains, deceptive names, or misuse of real accounts. Distinguish the mechanism before deciding what a check actually proves.
Business Email Compromise
A Trusted Role Can Be Used to Redirect Money or Data
Business email compromise, abbreviated B E C, targets money or sensitive information through apparent business trust. The request is often researched and tailored to the organization. An executive impersonation message may demand an urgent, confidential transfer. The supposed leader may claim to be traveling or unavailable. A vendor-redirection message instead claims that banking details changed for a legitimate invoice. The invoice can be real while the payment destination is fraudulent. Verify authority and account changes through an independently established channel. Do not use the suspicious message’s own contact details as the only confirmation. A B E C message may contain neither an attachment nor a link. It can rely on a persuasive request, while some cases also involve technical compromise of a real mailbox. Social pressure and technical intrusion can therefore coexist rather than describe entirely separate kinds of fraud.
Malicious Attachments
The File’s Apparent Name Does Not Establish Safe Behavior
Malicious attachments can take several familiar forms. A document may contain active content that runs code if execution is permitted. Do not enable unexpected active content merely because the message requests it. A compressed archive can contain a harmful executable or other file. Its familiar package format does not establish the contents are safe. A deceptive icon or multiple extensions can obscure the actual file type. Complete filenames and approved security checks provide more information than appearance alone. Opening or interacting with a file can create risk. However, one click does not invariably produce infection. Execution conditions, vulnerabilities, permissions, and protective controls affect the outcome. Treat unexpected files cautiously and use the organization’s established reporting procedure when the request or file is suspicious.
Embedded Links
The Visible Label and Actual Destination May Differ
An embedded link’s visible label can differ from its actual destination. A shortened address can also conceal where a user will arrive. One harmful destination imitates a login page to collect credentials. Another may attempt to distribute malicious software. Successful infection depends on the destination, device, interaction, and defenses. Where supported, preview the destination without opening it. That habit is useful, but it does not guarantee safety. A similar domain, redirect, or compromised legitimate site can still mislead. For sensitive actions, use an independently known official address or established app. Verify unexpected requests rather than assume the message’s route is trustworthy. A preview contributes evidence; the broader verification process determines whether the request and destination should be trusted.
Spam and Scale
Unsolicited Bulk Email Can Carry Advertising or Malicious Offers
Spam is unsolicited bulk email sent to many recipients. Some messages are unwanted advertising. Others carry scams, false prize claims, or phishing. Volume-based deception seeks enough responses from a very large audience. The source describes millions of messages with low response rates as one possible incentive. Actual profitability depends on costs and results, rather than a guaranteed rate of success. Targeted business email compromise emphasizes organizational context and trusted roles. Bulk campaigns emphasize reach, although the categories can overlap. Filters reduce the number of unwanted messages recipients encounter. A message arriving in the inbox has not thereby been proven legitimate. Assess the content and requested action, and remember that filtering is one defense within a larger process.
SPF and DKIM
Server Authorization and Domain Signatures Check Different Things
SPF means Sender Policy Framework. It checks whether a sending server’s address is authorized for the domain being evaluated. The policy is published through domain name system records. The checked identity is an envelope-sender or server greeting domain, rather than directly the visible From address. SPF alone does not confirm a named person’s authority. DKIM means DomainKeys Identified Mail. A cryptographic signature associates a signing domain with protected message content. Verification assesses the signed material under the signature’s rules. The signing domain can differ from the visible sender domain. A valid signature does not independently prove that the named human authored or approved the message. Server authorization and domain signatures check particular claims; they do not guarantee safe content or authorize requested actions.
DMARC
Alignment Connects Authentication with the Visible Sender Domain
DMARC means Domain-based Message Authentication, Reporting, and Conformance. It builds on SPF and DKIM while checking their domain alignment with the visible From domain. A passing SPF envelope-sender domain that aligns can satisfy DMARC. A passing DKIM signing identifier that aligns can also satisfy it. Both checks do not always need to pass. One failed check therefore does not automatically produce a DMARC failure. If no passing identifier aligns, the DMARC authentication condition fails. Domain owners publish handling preferences and can request reports. Receivers use their own policies when deciding what to do with available results. Reports help domain owners understand use and configuration. The key distinction is authenticated, aligned domain use; that result still does not prove safe content or a trustworthy request.
Receiving Decisions
Authentication and Content Checks Inform Local Handling
A receiving service combines several kinds of evidence when handling mail. Authentication evaluates domain authorization and alignment. Content filtering examines suspicious material, behavior, reputation, attachments, and links. Local policy determines how those results influence handling. Delivery, quarantine, and rejection are possible outcomes. Quarantine can restrict a message or hold it for review. Rejection means the receiver does not accept the message. The diagram is conceptual; exact processing differs between services. An authentication pass does not require the receiver to treat dangerous content as safe. Likewise, local policy can influence how failed authentication is handled. A delivered message still needs judgment about the actual identity claim, content, and authority behind the requested action.
Complementary Defenses
No Single Check Establishes Identity, Safety, and Authorization
Authentication, filtering, and independent verification serve complementary purposes. SPF, DKIM, and DMARC reduce particular forms of unauthorized domain use. They do not eliminate look-alike domains, deceptive display names, or compromised-account requests. Content filters assess harmful files, links, and suspicious patterns. A persuasive request can still lack the features those checks are designed to catch. Independent verification confirms a sensitive action through an established channel. Reliable contacts and consistent procedures matter. Reporting gives the responsible team evidence to assess and respond. Neither inbox delivery nor one warning sign settles every case. A request invoking seniority, urgency, or secrecy should not bypass ordinary payment approval or bank-change checks. Technical controls reduce exposure, while sound organizational processes help prevent a believable message from becoming an unauthorized transaction.
Review and Apply
Ask What Was Authenticated and What Still Needs Verification
The From address alone cannot establish who authorized a message. It may be forged, displayed misleadingly, or belong to a compromised real account. Business email compromise uses targeted context and trusted-role requests. Bulk scams instead emphasize volume, although an operation can mix those approaches. A file-and-link filter may miss a harmful request containing neither. SPF checks sending-server authorization for its evaluated transport domain. It does not directly verify the visible person’s authority. DKIM supplies a signing-domain association and protected-content verification. DMARC connects passing identifiers with the visible sender domain through alignment, handling preferences, and reporting. Authentication and filtering still need independent checks for sensitive requests. Evaluate the sender claim, message content, and requested action together, using established approval and reporting processes.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About How Email Has Become One of the Primary Delivery Channels for Scams and Attacks
What is the difference between email spoofing and a look-alike domain?
What is business email compromise (BEC)?
What is the difference between SPF, DKIM, and DMARC?
How can you tell if an email link or attachment is dangerous?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →