Phishing Awareness & Resources

Urgent call to action or threats

Be suspicious of any email or message that claims you must click, call, or open an attachment urgently. Often, the email will attempt to create a false sense of urgency either by offering a reward or warning of a penalty if the action is not taken. By creating a sense of urgency, you might be more likely to act quickly without first verifying that the email is legitimate.

Asking you for passwords, codes, or patient information

In a clinic setting, phishers may be attempting to obtain patient information or passwords rather than your banking information. Be wary of any emails asking you to look at an attachment (like a photo or document) or fill out a form, especially if there is an attempt to create a sense of urgency. The phishers may pose either as a patient or as a professional contact.

First time, infrequent, or external senders

While in a clinic setting it is not unusual to receive emails from an address or person you don’t recognize, there are contexts in which this is a red flag. If your email provider has flagged the email as an unrecognized sender or external, but it appears to be from someone from whom you have received emails before, this is an indication that this may be a case where someone is attempting to phish you by pretending to be a known and legitimate contact. Pay attention to the email addresses and any warnings that your email application may provide, as they can be indications that this email may not be legitimate.

Generic greetings

It is easy to personalize even mass emails in this day and age – even newsletters tend to use a personalized greeting. If the message is addressed with a generic “dear sir / madam” but appears to be from a sender (either an individual or an organization) who should know your name, this should give you pause.

Spelling and poor grammar

This used to be a common way to spot phishing tactics, but with the rise of sophisticated techniques and the use of AI-generated text, is less of a reliable indicator than it used to be. While professional organizations have writing and editing teams to ensure that their communications are free of any basic spelling or grammatical errors, many scam emails can have these types of errors as they do not have the resources to ensure they are proof-read. Be very cautious if you note any spelling or grammar errors in an email, especially when it appears to be coming from a company or organization rather than an individual.

Fake or suspicious links or attachments

If you receive an email or text message that you find suspicious, do not open any attachments or click on any links, as this can be all that is needed to install malicious software on your computer. If the attachment is strangely named or just seems unusual, or if the link seems odd (for example, if when you hover over it, the URL displayed in the tooltip does not match the URL that’s shown), then do not click or open it.

An example from the Microsoft page on phishing showing how the actual URL of the link (shown when hovering the cursor over the link) is to a string of numbers rather than a legitimate website

Fake or mismatched domains

Almost all phishing emails will use fake or mismatched domains, which is to say the part of the email after the “@”, or for websites, what we think of as the address. For example, the domain of this website is “vancouverdivision.com”. The domain is only the last part of the email (after the “@”), or the first part of the url (before the “/”, if there is one). Here is an example of a link to this page and an email, with the domain bolded.

https://vancouverdivision.com/resource/pmh-connectivity-phishing-resources/

example@vancouverdivision.com

There are a couple of ways scammers will use fake or mismatched domains to make it appear as if their email or links are legitimate, but which are not associated with the company they are trying to impersonate and instead under their control.

Here are a few ways domains can be subtly altered to trick you into thinking it is legitimate:

If you see a fake or mismatched domain in either the sender’s email address, or in the link(s) contained within the email, this is an immediate and definitive red flag that this email is likely an attempt to scam or phish you.