# Security Experts - what do you think about this situation? **URL:** \ **Category:** Factual Questions\ **Created:** [April 25, 2021, 10:15pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757 "2021-04-25T22:15:19Z")\ **Posts on this page:** 14\ **Page:** 2
**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\ **Post date:** [April 26, 2021, 3:44pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/21 "2021-04-26T15:44:10Z")
Google is your friend. If you get an email that seems to be from [Orinoco.com](http://Orinoco.com)’s finance department telling you they need bank details and including a handy link, you should look their published address up and check with them that way. ---
**Author:** ![Aspidistra](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aspidistra/32/3894_2.png) [@Aspidistra](https://boards.straightdope.com/u/Aspidistra)\ **Post date:** [April 26, 2021, 9:02pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/22 "2021-04-26T21:02:30Z")
> [@steronz](#): > > In defense of the organization in question here, based on what the OP says, it’s not a bank, but rather an organization that makes payments to their bank and saves that banking information. It could just be the account and routing numbers, which are of course printed on every check you hand out. I don’t believe there’s a lot you can do with that information, other than give people free money, but I’m out of my element here – while I have to understand web security as part of my job, I don’t deal with financial information. You are mostly correct, but as it happens the organisation in question _also_ has credit card details, available from the same page, for those instances where the member owes them money. If in a month’s time I get another dubious-looking mail saying “okay, now we need to update your credit card details”, I’ll revive the thread ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [April 26, 2021, 9:14pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/23 "2021-04-26T21:14:32Z")
I still recommend looking at the email headers. It should be pretty simple to confirm whether or not it originated from the organization. You can use [this Google tool](https://toolbox.googleapps.com/apps/messageheader/) if you’re not familiar with parsing SMTP headers. ---
**Author:** ![K364](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/k364/32/5_2.png) [@K364](https://boards.straightdope.com/u/K364)\ **Post date:** [April 26, 2021, 9:27pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/24 "2021-04-26T21:27:51Z")
I know a company that sends emails like this as part of a mock-phishing attempt to see who is dumb enough to click on the link. I you do, you will be counselled by your supervisor and a couple more failures on your part will lead to other discipline. ---
**Author:** ![Aspidistra](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aspidistra/32/3894_2.png) [@Aspidistra](https://boards.straightdope.com/u/Aspidistra)\ **Post date:** [April 26, 2021, 9:35pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/25 "2021-04-26T21:35:34Z")
(ETA: re mail headers) I should have said - I did already do this. I’m not completely on top of all the various bits of a mail header, but I can see that all the domain names mentioned in the mail are either [something.organisation.com](http://something.organisation.com) (where [organization.com](http://organization.com) is the correct top level domain) or references to my own isp handling the mail. There’s nothing dodgy-looking in the plain text of the source that’s identifiable from a moderate-noob-look ---
**Author:** ![Melbourne](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Melbourne](https://boards.straightdope.com/u/Melbourne)\ **Post date:** [April 26, 2021, 9:42pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/26 "2021-04-26T21:42:04Z")
> [@markn\_1](#): > > I still recommend looking at the email headers. It should be pretty simple to confirm whether or not it originated from the organization. Like the contents of the message, the writing on the outside of the envelope can be easily forged. Messages from your bank _should_ have a signature on the outside of the envelope\*, and headers without that should be rejected by Gmail and [Outlook.com](http://Outlook.com). But messages from other senders often have headers that can easily be forged. \* technical details simplified ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [April 26, 2021, 9:52pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/27 "2021-04-26T21:52:31Z")
Most of the email headers, like From and Reply-To, can be forged, but the Received header chain at the start of the message are trustworthy if you know how to interpret them. There are more sophisticated mechanisms to prevent spoofing like DKIM, but just looking at the Received chain will identify most spoof attempts. ---
**Author:** ![DrDeth](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@DrDeth](https://boards.straightdope.com/u/DrDeth)\ **Post date:** [April 26, 2021, 10:02pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/28 "2021-04-26T22:02:03Z")
> [@steronz](#): > > I don’t have a GQ answer per se, but IF it’s an https link, and IF you’re using a modern, up to date browser, it’s unlikely to be any kind of phishing attack. Yes, but they shouldn’t be sending out a link like that. Their security depot should know better. I get messages from my banks and from Visa. Some are legit, some are not. I go to the source directly not using any links in the email. ---
**Author:** ![Melbourne](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Melbourne](https://boards.straightdope.com/u/Melbourne)\ **Post date:** [April 26, 2021, 10:04pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/29 "2021-04-26T22:04:09Z")
> [@markn\_1](#): > > Received header chain at the start of the message are trustworthy if you know how to interpret them The received header chain identifies most spoofed email, but it is by no means trustworthy. “From” and “Reply-To” fields are _inside_ the envelope: they are equivalent to the letterhead on a page. The received header chain is from the _outside_ of the envelope: trusting that a message came from your bank because the received header chain says so is equivalent to trusting that a letter came from your bank because the postman said so. ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [April 26, 2021, 10:14pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/30 "2021-04-26T22:14:52Z")
The Received chain is outside the control of the sender. If you think arbitrary mail servers are compromised then yes, you can’t trust the headers, just like your postman might be in cahoots with someone who’s sending you scammy paper mail. But that’s a much less likely scenario than the sender working alone. The sender has no control over any Received headers prepended to the start of the email after it leaves their computer. ---
**Author:** ![Melbourne](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Melbourne](https://boards.straightdope.com/u/Melbourne)\ **Post date:** [April 26, 2021, 10:23pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/31 "2021-04-26T22:23:05Z")
> [@markn\_1](#): > > The sender has no control over any Received headers prepended to the start of the email after it leaves their computer. What exactly are you expecting to see in the chain? I have complete control of any chain I wish to include when it leaves my computer, I can spoof my own computer, I can send it directly to Gmail, and after it gets to Gmail, it’s only the Gmail computers. The only difficulty is getting it accepted by Gmail, and that’s not impossible. Gmail uses a combination of examining the envelope and the message inside to classify mail, and if it was so clear that you could reliably reject it by examining the receive chain, Gmail would already have done so. You bring additional information when you examine the receive chain, but when it gets to your provider, your provider is just repeating what it’s been told. ---
**Author:** ![md-2000](https://avatars.discourse-cdn.com/v4/letter/m/9d8465/32.png) [@md-2000](https://boards.straightdope.com/u/md-2000)\ **Post date:** [April 27, 2021, 1:10pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/32 "2021-04-27T13:10:11Z")
A serious possibility too is that hackers have compromised the public-facing login server, but not the back end database servers. So their choices are to try to brute-force guess passwords, wait for people to enter new passwords, or try to trigger new passwords; or maybe it’s not the passwords, it’s the other banking data they can’t access on their own and need for it to pass through the server in clear text. Highly unlikely, but still - ANY request for credentials or sensitive data that includes a “click here” link is beyond suspect. Any IT department that does not realize this should not be trusted either. ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [April 27, 2021, 4:55pm UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/33 "2021-04-27T16:55:54Z")
> [@Melbourne](#): > > What exactly are you expecting to see in the chain? I have complete control of any chain I wish to include when it leaves my computer, I can spoof my own computer, I can send it directly to Gmail, and after it gets to Gmail, it’s only the Gmail computers. You can make a false chain, saying that your computer accepted the message from BankAhoy, and then you pass it on to Gmail. Gmail is going to show that it accepted it from you. So when looking at the headers I’ll see BankAhoy-\>Melbourne-\>Gmail, and I’ll say, what is Melbourne doing in there? I expect the message to come from BankAhoy. If BankAhoy is using SPF, then Gmail is going to ask BankAhoy, hey, can Melbourne deliver mail for you? And BankAhoy will say no, only BankAhoySMTP can deliver mail for us: spam alert! Take it up a level to DKIM, and BankAhoy will sign their headers, and Gmail will check and see if that signature was made with BankAhoy’s secret key. Or you spoof BankHello, which is easily spoofable, because they don’t bother with things like SPF or DKIM. Gmail will have a low opinion of them, so their customers will complain of missed messages. What bothers me is that many legitimate emails use some type of email service, like sendgrid, that re-writes links. I’ve received actual emails from my employer’s security department warning about checking links, which contain re-written links that don’t go where they say, and not as a security test, but as an unintended consequence of the mailing list software. ---
**Author:** ![Steven\_Maven](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steven_maven/32/3272_2.png) [@Steven\_Maven](https://boards.straightdope.com/u/Steven_Maven)\ **Post date:** [May 13, 2021, 5:32am UTC](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757/34 "2021-05-13T05:32:08Z")
> [@griffin1977](#): > > I never respond to anything directly in a circumstances like this, instead I contact the alleged sender via a reliable communication channel _not_ listed in the email. I agree. Never click a link in an unexpected or unsolicited email. There is no guarantee that it will do what it says. [Previous page](https://boards.straightdope.com/t/security-experts-what-do-you-think-about-this-situation/940757.md?page=1)