11 Checklist Questions to Help You Spot an Online Imposter

Imposters online can make your life miserable.

If you miss the signs and end up welcoming them into your connection circles, it can only mean one thing – bad news!

Take a look at the questions below that you can use to help determine the truth from a lie.

Social Media

1.) Is the profile picture featured a legitimate photo? If the photo is left blank, contains an avatar, features a model, or is simply low-quality, be suspicious and ask yourself if the connection request is worth the risk.

2.) Have I checked their username? Fake profiles will typically feature foreign usernames or usernames that contain numbers. While it would be almost impossible to tell if an account was fake simply by the username, it could be one more warning sign when combined with everything else.

3.) Does their bio make sense? Before connecting with anyone online, please do your due diligence to find out what they’re all about. If their bio features suspicious links or incorrect English (grammar, not spelling), you’ll want to steer clear.

4.) What type of content have they shared? If their account doesn’t have any recent activity, or they tend only to reshare content and not post anything original, that’s a red flag to take note of.

5.) How many followers do they have? Profiles with a low number of followers and not a lot of profile information should tell you that it’s not worth the risk of connecting with them. If you really want to play it safe, stick with connections you’ve either met personally or have connections with people you’ve met in person.

---

Top Social Media Email Subjects from KnowBe4 Top-Clicked Phishing Tests

• LinkedIn (42%)
  • “You appeared in new searches this week!”
  • “Please add me to your LinkedIn Network”
  • “You have requested a reset to your LinkedIn password”
  • “People are looking at your LinkedIn profile”
• Facebook (20%)
  • “Your friend tagged you in photos on Facebook”
• Twitter (9%)
  • “Someone has sent you a Direct Message on Twitter!”

---

Phishing Emails and Fake Website Accounts

6.) Have you checked the sender’s email address? Phishing emails are notorious for copying the sender’s name exactly but then having a weird email address. For example, the email may say it’s coming from “Dave Hultin,” but the email address is listed as something wonky like davey_xps751@yahoo.com.

7.) Does the domain name check out? Most legitimate emails will come from email addresses that list the business’s domain name—for example, joeprinter@AcmePrintingUSA.com. If you see email addresses that end in @gmail.com or @yahoo.com, take a second look.

8.) Did the email contain any personalization? Phishing emails will most commonly use generic greetings, such as “Dear valued member” or “Dear account holder.” While this is not a dead giveaway of a phishing email, if you do see it, it should encourage you to perform some double-checking before you take any action with the email.

9.) Is the email poorly written? Read the email and look for grammar inconsistencies, not necessarily spelling mistakes. Many scammers will use a spell checker to ensure proper spelling, but the grammar misuses will be quite glaring. Here’s an example from an email claiming to come from the Miami University Community Federal Credit Union:

“It has come to our attention that your acounts information has need to be confirmed due to inactive customers, fraud and spoof reports. For this reason, your account has been suspended until you take further action.

 If you could please take 5-10 minutes out of your online experience and renew your records you will not run into any future problems with the online service. However, failure to confirm your records my result in your account suspension.”

10.) Is the email trying to get you to act quickly by pushing urgency? Just as in real-life fishing, if you wait too long, you might lose the fish. To help ensure their targets take the bait, scammers will add language meant to scare, intimidate, and get you to act immediately without thinking it completely through.

---

Top 10 Most-Clicked General Phishing Email Subjects in Q1 2021:

1. Password Check Required Immediately
2. Revised Vacation & Sick Time Policy
3. COVID-19 Remote Work Policy Update
4. COVID-19 Vaccine Interest Survey
5. Important: Dress Code Changes
6. Scheduled Server Maintenance — No Internet Access
7. De-activation of [[email]] in Process
8. Test of the [[company_name]] Emergency Notification System
9. Scanned image from MX2310U@[[domain]]
10. Recent Activity Report

---

11.) Does the email feature strange links to other websites? It’s not uncommon for phishing emails to mask or change the link text within an email. For example, the text of the link displayed to the reader may appear legitimate (http://www.ndsu.com…), but if you hover your mouse cursor over the link, the popup window that appears and shows that where the link actually goes is completely different and not associated with the link text (http://www.uscollegeunionsys.com/notfraud…”).

Website Accounts

Here is an example of a fake account scam that snuck its way in through the Contact Us page of a client’s website. Take a look at the different ways to tell that this is spam.

Donna (Donna) submitted the following message via the Contact Us page.
Email: Workmonshot871@gmail.com (1)
Phone: 19179325292
Hello! (2)

My name is Donna.

Your website or a website that your organization hosts is infringing on a copyrighted images (3) owned by me personally.

Check out this document with the links to my images you used at www.accucolor.biz and my previous publications to get the evidence of my copyrights.

Download it right now (4) and check this out for yourself:

https://firebasestorage.googleapis.com/v0/b/storage-42e83.appspot.com/o/shared%2Ffile-dkfh3gdfh3b.html?alt=media&token=0496760f-dee0-4e13-8042-a5956e708088&fileID=037424754922647279 (5)

I really believe that you intentionally violated my legal rights under 17 U.S.C. Section 101 et seq. and could be liable for statutory damages as high as $140,000 as set forth in Section 504 (c) (2) of the Digital millennium copyright act (DMCA) therein.

This letter is official notification. I demand the elimination of the infringing materials described above. Please be aware as a service provider, the Dmca demands you, to remove or disable access to the copyrighted content upon receipt of this notification letter. In case you do not stop the use of the above mentioned infringing materials a law suit can be started against you.

I do have a good self-belief (6) that utilization of the copyrighted materials mentioned above as presumably infringing is not approved by the copyright proprietor, its legal agent, or the law.

I declare, under consequence of perjury, that the information in this letter is correct and that I am currently the legal copyright owner or am authorized to act on behalf of the proprietor of an exclusive right that is allegedly violated.

Best regards,
Donna Workmon

06/16/2021

(1) Generic Email Domain
(2) Impersonal Greeting
(3) Grammar Misuses
(4) Urgent Language
(5) Strange and Suspicious Links
(6) Grammar Misuses

As a side note, use Google (or other search engines) to your advantage. A search of “Fake Copyright Infringement” quickly leads to articles warning of this scam and even lists the exact email content the recipient received. You can also search any of the contact information listed in the content you received or by topic of the content in question. The little bit of time you spend doing some due diligence here will save you tremendously in the longrun.

When in Doubt…

One of the best defenses you have when it comes to spotting imposters online is to slow down enough to give your “gut feel” a chance to kick in. Look things over carefully and, when in doubt, reach out and ask someone for help.

Lastly, if you’re questioning whether or not you’re dealing with an imposter, reach out to our Tech Support team for help.

 

Other Resources:

How Do I Prevent Spam Bots from Creating Fake Accounts on My Website?