public:emai:senderverify [CERGE-EI Infrastructure Services]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Verify the credibility ======
**Better safe, than sorry.** See guide [[:public:emai:spam|Spam, Phishing and Malware]] and [[:public:emai:malware|Dealing with malware, spam, suspicious content]]

Be cautious, restrained, distrustful, safety is yours, next is only help.

Five steps to verify the credibility of the message
  - Verify the sender
  - Verify the URL (web link)
  - Verify the signature
  - Verify the content
  - Ask in doubt


===== Verify the real sender =====

  * Everytime you receive any email, verify the true sender.
  * Regardless of detecting email as a suspicious by the spamfilter.

How difficult it is and how to do it exactly depend on the email client. But shortly saying:

  - See the complete address in the form of somebody@somewhere.domain We do not allow outside sender to spoof @cerge-ei.cz domain.
  - In case of any doubt, doublecheck it by call or email ask.
  - Read the next articles as an example how to check real sender. The last article helps you to analyze the complete message path protocol, if you need it. \\ Do not worry, it seems difficult, but in fact the quick proof can be simple. Is the header too complex, too long and with server addresses from outside of cerge-ei domain? Then it could not be the true cerge-ei message.

[[https://ithelp.brown.edu/kb/articles/view-a-sender-s-email-address-in-gmail|How to see the real email sender in Gmail]]

[[https://lifehacker.com/how-can-i-find-out-where-an-email-really-came-from-1190061668 |How to find the true sender in the message header]]
===== Verify the link =====
  * Phishing often uses fake institutional pages, e.g. email login, internal web login, etc. The look could be fine, but the link goes elsewhere. __Check link before you use it.__
  * Sometimes the cerge-ei domain is spoofed in the path to increase credibility. The complete path and the home domain at the end are decisive.
  * There are also sophisticated techniques using a similar domain name (like a typo) or fonts where the letter looks correct but the name is actually different.
===== Verify the signature =====
  * The signature is a significant indication of the trustworthiness of the message. Unknown, unusual or impersonal signature should be grounds for rejection or at least deep distrust.
  * Unfortunately on the other hand, the signature could be easily stolen or spoofed. You must not fully rely on the authenticity of the signature.
===== Verify the content =====
  * Check the style, language and content of the message. Beware of manipulative methods and social engineering.
  * **Do not succumb a time pressure** [[public:emai:spam|Spam, Phishing and Malware]]


===== Ask in doubt =====
Feel free to ask if you have any doubts and/or to report a suspicious or dangerous email.