Can you tell a real Facebook e-mail from a phishing attempt?

E-mail notifications are an important part of social networking services like Facebook. If you have to continually visit the site to see what’s new, you lose much of the excitement that comes with comments on your photos or other shared items. If you forget to check for a day or two, you might miss an invitation to an event or an opportunity to connect with a long-lost friend who’s in town for a day or two.

But e-mail notifications are also a security risk. If an attacker can create a realistic-looking imitation of a Facebook notification, you might find yourself clicking on a link that can lead to malware or attempt to steal your login credentials.

Unfortunately, phishers are getting better at what they do, and spotting a fake isn’t as easy as you might think. I’ve assembled four Facebook notifications that arrived in my e-mail inbox recently. Can you tell which are real and which are fake? (Click any image to see it at full size, or visit the accompanying gallery to flip through all four screens at full size.)

Here’s one that arrived last week. As with all the images, I’ve blurred personal information but otherwise these messages are shown in full, as they appear in Microsoft Outlook’s preview pane.

If you guessed that one was a fake, congratulations. It led to a website that was flagged as dangerous by Microsoft’s SmartScreen Filter, by Google’s Safe Browsing feature, and by Safari. If you were using an outdated browser such as Internet Explorer 6 or 7, you would have seen an attempt to install a fake Flash update that was actually a password-stealing Trojan.

OK, let’s try another. Real or fake?

Do you think that odd e-mail address indicates a fake? Confusingly, Facebook notifications come from the facebookmail.com domain and include a suspicious-looking sender’s name. The long, complicated URL might also look suspicious, but this notification is a legit one from Facebook.

OK, here’s a third test. Real or fake?

 Hmmm. The previous, real notification included a long complicated URL. This one has a pair of buttons that you’re supposed to click to see the comments a friend supposedly added to your shared link. That’s a favorite trick that phishers and spammers use to disguise misleading links. Surprisingly, this one is legit.

OK, last one. Real or fake?

This is a particularly convincing fake. The graphics, fonts, button design, and links are all indistinguishable from a real Facebook notification. This particular phishing attempt led to a fake online pharmacy, but it could just as easily have led to a malware installer.

One of these fakes was good enough to slip past my spam filters. In that case, the only way to determine that it wasn’t legit was to allow the mouse pointer to hover over a link or button to see what its true destination was. Here’s what it looked like:

That’s certainly not a legitimate link. Here, by contrast, is what a link from a real Facebook notification looks like:

It’s a challenge to get nontechnical users in the habit of checking links before they click, but the results are well worth it.

Share and Enjoy

Kuwait commission denies social media accounts ban

Manama: Kuwait’s Civil Service Commission (CSC) has denied reports it would ban government employees from accessing Twitter and Facebook, saying they were baseless allegations.

“There were no reports or complaints from government sector officials about an increasing use of social networking sites like Twitter and Facebook during work hours,” Mohammad Al Roumi, Undersecretary at the CSC, told Kuwait News Agency (Kuna).

The commission will not therefore issue a circular after the Eid holidays to warn government employees against logging on to social networking sites during work hours.

Last week, reports surfaced in Kuwait, quoting Al Roumi as saying that the CSC was planning to issue a circular after the Eid holidays to caution government employees against logging on to social networking at work.

Article continues below

According to the reports, the commission had complained that a large number of public sector employees regularly talked on the phone or logged on to social networking sites during work hours while others left their offices without informing their superiors, resulting in a slowdown of the workflow in several government institutions.

“The CSC has no authority to follow up the employees as this is within the prerogatives of their directors,” the commission said.

Share and Enjoy