...
- Attachments are executable files. Generally, attachments you receive will be documents or graphics with the corresponding “.doc,” “.pdf,” “.jpg,” or “.png” extensions. Never will it be appropriate for you to receive attachments that are “executable files,” or files that will actively run a program on your machine. These files end in extensions like “.exe,” “.com,” “.bat,” or “.scr” (or, more cleverly, a double extension like “.doc.exe”). Oftentimes these sorts of attachments will end up running a malicious program on your machine, so be sure to contact the sender (preferably by phone) prior to opening to verify that the file is legitimate.
- Hyperlinks are masked. Sending a web link in an email seems common and innocuous enough, right? As long as the link takes you where it claims to. Links to websites can easily be masked or hidden, meaning that a seemingly harmless URL could really be pointing you to a different site that is riddled with malware. To make sure that any links are safe, there are two easy ways to check their veracity: 1) hover your mouse over the link and check the URL that appears in the bottom left-hand corner of your screen; 2) right-click on the link and check its “Properties.” In either case, the URL on your screen or in the link properties should match the URL in the email. If there is hyperlinked text rather than a URL, make sure that the web address has only one domain (https://www.outlook.office356.com
as opposed to http://www.office365.malicioussite.com 
). - The links are for HTTP instead of HTTPS. Any link that starts with HTTP is unsecure and in most cases, should not be trusted. Legitimate links to known websites will usually, but not always, start with HTTPS. See below for an example.
- The email contains requests for personal information. Always be suspicious of messages that make requests for any sort of sensitive or personal information, even if it appears to come from someone you know.Whether it is your bank requesting information (or else you’re subject to a ridiculous fee!), your email provider requesting credentials (or else they’ll delete your account!), your CEO requesting immediate funds (or else she’ll miss her flight!), or a law enforcement official demanding your address and SSN (or else you’re obstructing an investigation!), verify the request before you do anything. Hackers have the ability to “spoof” emails (mask their email address with another), so that they appear to come from a trusted sender; in many cases, hitting “Reply” will reveal an unknown Gmail or Yahoo! account. Call the supposed sender to make sure the message came from them, and—just to be extra careful—begin a new email chain if and when you do respond to a legitimate request.
...