One of the things I’m asked to do regularly is advise on whether an email is genuine or not. We all know that a lot of emails are SPAM or PHISHing attacks and therefore we are rightly suspicious of the validity of any received email purporting to be from our bank, pension provider or broadband provider etc.
It’s impossible to say with absolute certainty whether an email is genuine or not but one can certain discount the vast majority to dodgy emails received.
One of the things I look for in an email is whether it comes from who it says it comes from. An email which claims to be from your bank but actually came from a Gmail email address is certainly fake. To do this check I look at the emails Internet Headers (or source). A sample below.
Return-Path: <info=cira.ca__0-2lh8l34z92fkbh.i8lueje0jwxrdnay@lb3gqi21kt8z3bed.3ufb1ne.c-16kpsmaa.na8.bnc.salesforce.com> Received: from mx1.myemailfilter.com (mx2.myemailfilter.com [65.39.206.207]) by mx1-tx2.realssl.com with SMTP; Fri, 22 Sep 2017 10:26:38 -0400 Received: from smtp07-phx-sp1.mta.salesforce.com (smtp07-phx-sp1.mta.salesforce.com [136.147.46.230]) by mx1.myemailfilter.com with SMTP; Fri, 22 Sep 2017 10:26:11 -0400 Return-Path: <info=cira.ca__0-2lh8l34z92fkbh.i8lueje0jwxrdnay@lb3gqi21kt8z3bed.3ufb1ne.c-16kpsmaa.na8.bnc.salesforce.com> Received: from [10.246.203.35] ([10.246.203.35:38744] helo=na8-app1-7-phx.ops.sfdc.net) by mx3-phx-sp1.mta.salesforce.com (envelope-from <info=cira.ca__0-2lh8l34z92fkbh.i8lueje0jwxrdnay@lb3gqi21kt8z3bed.3ufb1ne.c-16kpsmaa.na8.bnc.salesforce.com>) (ecelerity 3.6.25.56547 r(Core:3.6.25.0)) with ESMTPS (cipher=DES-CBC3-SHA) id 70/6B-04543-05C15C95; Fri, 22 Sep 2017 14:21:04 +0000 Date: Fri, 22 Sep 2017 14:21:04 +0000 From: CIRA Product Support <info@cira.ca> To: "alan@lr-clouds.co.uk" <alan@lr-clouds.co.uk> Message-ID: <l7AS1000000000000000000000000000000000000000000000OWOQJ4009KGvC6zDQc-vz9lSVwHWbw@sfdc.net> Subject: Offline Survey from the Support queue on CIRA.ca [ ref:_00DC016kps._500C01AJypW:ref ] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_6345_2080497528.1506090064814" X-SFDC-LK: 00DC00000016kps X-SFDC-User: 005C0000009soM0 X-Sender: postmaster@salesforce.com X-mail_abuse_inquiries: http://www.salesforce.com/company/abuse.jsp X-SFDC-TLS-NoRelay: 1 X-SFDC-Binding: 1WrIRBV94myi25uB X-SFDC-EmailCategory: emailAuthorEmail X-SFDC-EntityId: 500C000001AJypW X-SFDC-Interface: internal X-SmarterMail-Spam: ISpamAssassin 0 [raw: 0] X-SmarterMail-TotalSpamWeight: 0
But if the email wasn’t sent to me how can I look at the Internet Headers? A simple forward of the email does not forward on the Internet Headers. The original email needs to be send to me as an attachment not just a straight forward.
In Outlook 2016 “Forward as an Attachment” can be quite tricky to find. There’s two ways to quickly access this function
Option 1 is type into the “Tell me what you want to do?” box Forward as an Attachment the option will then pop up in the dropdown list.
Option 2 Is to choose More from the Respond group in the ribbon bar. However unless you are displaying the screen full screen then you are unlikely to see this item.
Do treat emails received with care.
Never click on links in emails
Always err on the side of caution