I’m not sure how many times I have said “Be careful with messages (Instant Message, Email, Facebook, etc) don’t trust them even if they say they are from someone you know”. The following email is supposed to be from a family member** of mine. I talked to them about the email and they didnt realize that when they received the email from someone they knew and clicked on the link in the email that the email had automatically forwarded itself, even making it look like the family member was the one sending it. (**I did ask for permission from this relative prior to using his email) 
Malware writers have been using these social engineering tricks for years in an attempt to get people to drop there guard and click on email links or download attachments. In real life, we hear news stories of bad guys dressing up as city employee’s or law enforcement and then tricking home owners into letting them in, where the bad guys then proceed to steal from the home owner (Here is a release by the Chicago Police Department concerning crooks who use fake uniforms for access http://www.chicagopolice.org/MailingList/PressAttachment/YourCastle.pdf (http://www NULL.chicagopolice NULL.org/MailingList/PressAttachment/YourCastle NULL.pdf)). This email (and those like like it) can be considered the cyber equivalent of the fake cop or fake city worker.
In real life we understand that if you aren’t expecting the gas company or phone company and someone shows up at your door asking to check something in your home, that you question them, check there uniform, ID, see if they have a company vehicle, and even call the business that they are claiming to be from to make sure that the person at your door is actually from where they say they are. In cyber space, it seems because no one really understand how things work (TGM is working hard to change that), that most people just assume if it has someone’s name on it that they know that “it must be from them”. Well Nope and lets go over a few things in this email that clearly show it wasn’t from my relative –
- “To:” – Its not addressed to me, since To: is blank even though it is supposed to be an email from someone I know to me.
- “Was bored so planned to write you” – I know my relative and there are 2 points here.
- 1 – He knows English and knows how to write in complete sentences
- 2 – He would not say something like “Was bored so planned to write you”.
Ok with that being said, again as always, in cyberspace act the same as you would if you were somewhere outside of your home in real life, pay attention to your surrounding, and for pete-sake if you run into someone on a street corner selling you Jack’s Magic Beans, dont buy them.
