Digital First Aid Kit/topics/suspicious-messages.md — English @ L10N.SPACE: > In this scenario, a service provider is any company …

The translation is temporarily closed for contributions due to maintenance, please come back later.
The translation was automatically locked due to following alerts: Could not merge the repository.

Zen

Source string Source string

English

> In this scenario, a service provider is any company or brand that provides services you use or are subscribed to. This list can contain your email provider (Google, Yahoo, Microsoft, ProtonMail...), your social media provider (Facebook, Twitter, Instagram...), or online platforms that have your financial information (Paypal, Amazon, banks, Netflix...).
>
> Is there a way that you can check if the message is authentic? Many service providers will also provide copies of notifications or other documents in your account page. For example, if the message is from Facebook, it should be included in your [list of notification emails](https://www.facebook.com/settings?tab=security&section=recent_emails), or if it is from your bank, you can call your customer service.

Needs editing

This translation is currently locked.

Skip

	English	Actions
	You may receive _suspicious_ messages to your email inbox, social media accounts and/or messaging applications. The most common form of suspicious emails is phishing emails. Phishing emails aim to trick you into giving up your personal, financial, or account information. They may ask you to visit a fake website or call a fake customer service number. Phishing emails can also contain attachments that install malicious software on your computer when opened.
	If you are not certain about the authenticity of the message you received, or what to do about it, you can use the following questionnaire as a guiding tool to further diagnose the situation or to share the message with external trusted organizations that will provide you with a more detailed analysis of your message.
	Keep in mind that receiving a suspicious email does not necessarily mean that your account has been compromised. If you think an email or message is suspicious, don't open it. Don't reply to the email, don't click any links, and don't download any attachments.
	## Workflow
	### intro
	Have you performed any action on the message or link?
	- [I clicked a link](#link-clicked) - [I entered credentials](#account-security_end) - [I downloaded a file](#device-security_end) - [I replied with information](#reply-personal-info) - [I have taken no action yet](#do-you-know-sender)
	### do-you-know-sender
	Do you recognise the sender of the message? Be aware that the sender of the message may be [spoofed](https://en.wikipedia.org/wiki/Email_spoofing) to appear to be someone you trust.
	- [It is a person or organisation who I know](#known-sender) - [It is a service provider (such as an email provider, hosting, social media or bank)](#service-provider) - [The message was sent by an unknown person or organisation](#share)
	### known-sender
	> Can you reach the sender using another communication channel? For example if you received an email, can you verify it directly with the sender by Signal, WhatsApp or phone? Be sure to use an existing contact method. You cannot necessarily trust a phone number listed in the suspicious message.
	Did you confirm that sender is the one that sent you this message?
	- [Yes](#resolved_end) - [No](#share)
	### service-provider
	> In this scenario, a service provider is any company or brand that provides services you use or are subscribed to. This list can contain your email provider (Google, Yahoo, Microsoft, ProtonMail...), your social media provider (Facebook, Twitter, Instagram...), or online platforms that have your financial information (Paypal, Amazon, banks, Netflix...). > > Is there a way that you can check if the message is authentic? Many service providers will also provide copies of notifications or other documents in your account page. For example, if the message is from Facebook, it should be included in your [list of notification emails](https://www.facebook.com/settings?tab=security&section=recent_emails), or if it is from your bank, you can call your customer service.
	Choose one of the below options:
	- [I was able to verify it is a legitimate message from my service provider](#resolved_end) - [I wasn't able to verify the message](#share) - [I am not subscribed to this service and/or expecting a message from them](#share)
	### link-clicked
	> In some suspicious messages, the links can take you to fake login pages that will steal you credentials or other type of pages that might steal your personal or financial information. Sometimes, the link might ask you to download attachments that install malicious software on your computer when opened. The link can also take you to a specially prepared website that may try to infect your device with malicious or spying software.
	Can you tell what happened after your clicked on the link?
	- [It asked me to enter credentials](#account-security_end) - [It downloaded a file](#device-security_end) - [Nothing happened but I am not sure](#clicked-but-nothing-happened)
	### clicked-but-nothing-happened
	> The fact that you clicked on a suspicious link and you didn't notice any strange behaviour doesn't meant that no malicious action took place in the background. There are some scenarios that you should think about. The least concerning is that the message you received was spam used for advertising purposes. In this case some ads will pop up. In some cases these ads could be malicious too.
	- [Some ads popped up. I'm not sure if they are malicious or not](#suspicious-device_end)
	> In the worst-case scenario, by clicking on the link an exploit took place to execute a malicious command on your system. If this happened, this may be due to the fact that your browser is not up-to-date and has a vulnerability allowing this exploit. In rare cases where you browser is up-to-date and this scenario happened, the exploited vulnerability could be not known. In both cases, your device could start to act suspiciously.
	- [Yes my browser is not up to date and/or my device started to act suspiciously after I clicked the link](../../../device-acting-suspiciously)
	> In other scenarios, by visiting this link you may have been a victim of a [cross-site script attack (or XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting). The result of this attack will be the stealing of your cookie used to authenticate you to the visited website, so the attacker will be able to log into the site with your username. Depending on the security of the site, the attacker may or may not be able to change the password. This becomes more serious if the website that is vulnerable to XSS is a site you manage, because in such cases the attacker will be able to authenticate as the admin of your website. In order to identify an XSS attack, check if the link you clicked contains a [script string](https://owasp.org/www-community/attacks/xss/). This could be also encoded in HEX or Unicode.
	- [There is a script in the link or it is partially encoded](#cross-site-script) - [No script could be identified](#suspicious-device_end)
	### cross-site-script
	Is the site you visited a site you have an account in?

	English	Actions
	# I Received a Suspicious Message
	You may receive _suspicious_ messages to your email inbox, social media accounts and/or messaging applications. The most common form of suspicious emails is phishing emails. Phishing emails aim to trick you into giving up your personal, financial, or account information. They may ask you to visit a fake website or call a fake customer service number. Phishing emails can also contain attachments that install malicious software on your computer when opened.
	### do-you-know-sender
	Do you recognise the sender of the message? Be aware that the sender of the message may be [spoofed](https://en.wikipedia.org/wiki/Email_spoofing) to appear to be someone you trust.
	> Can you reach the sender using another communication channel? For example if you received an email, can you verify it directly with the sender by Signal, WhatsApp or phone? Be sure to use an existing contact method. You cannot necessarily trust a phone number listed in the suspicious message.
	> In this scenario, a service provider is any company or brand that provides services you use or are subscribed to. This list can contain your email provider (Google, Yahoo, Microsoft, ProtonMail...), your social media provider (Facebook, Twitter, Instagram...), or online platforms that have your financial information (Paypal, Amazon, banks, Netflix...). > > Is there a way that you can check if the message is authentic? Many service providers will also provide copies of notifications or other documents in your account page. For example, if the message is from Facebook, it should be included in your [list of notification emails](https://www.facebook.com/settings?tab=security&section=recent_emails), or if it is from your bank, you can call your customer service.
	Choose one of the below options:
	### suspicious-device_end
	- [Some ads popped up. I'm not sure if they are malicious or not](#suspicious-device_end)
	- [Yes](#account-security_end) - [No](#cross-site-script_end)
	Is the site you ended up in a website you manage?
	> In this case, the attacker may have a valid cookie that allows them to access your admin account. The first thing is to log into your administration interface and kill any active session or simply change the password. Also you should check if the attacker uploaded any artifacts to your site and/or posted any malicious content, and if so remove it.
	The following organizations can help investigate and respond to this incident:
	### reply-personal-info
	What kind of information did you share?
	- [I shared confidential account information](#account-security_end) - [I shared public information](#share) - [I'm not sure how sensitive the information was and I need help](#help_end)
	### share
	> Sharing your suspicious message can help protect your colleagues and community who may also be affected. You may also like to reach for help to someone you trust to advise you if the message is dangerous. Consider sharing the message with organizations that can analyze them. > > To share your suspicious message, make sure to include the message itself as well as information about the sender. If the message was an email, please make sure to include the full email including headers using the [following guide by the Computer Incident Response Center Luxembourg (CIRCL)](https://www.circl.lu/pub/tr-07/).
	- [Yes, I need more help](#help_end) - [No, I've solved my problem](#resolved_end)
	> In case some files were downloaded to your device, your device may be at risk!
	:[](organisations?services=device_security)
	Would you like to share information on the message you received or do you need further assistance before?
	> You should seek help from your colleagues or others to better understand risks from the information you shared. Other people in your organisation or network may also have received similar requests.
	If your account has been compromised and you need help to secure it, please contact the organizations below who can support you.
	:[](organisations?services=account)
	### analysis_end
	### final_tips
	Here are a number of resources to spot suspicious messages and avoid being phished.
	### service-provider
	### link-clicked

Loading…

None

String updated in the repository

English

> In this scenario, a service provider is any company or brand that provides services you use or are subscribed to. This list can contain your email provider (Google, Yahoo, Microsoft, ProtonMail...), your social media provider (Facebook, Twitter, Instagram...), or online platforms that have your financial information (Paypal, Amazon, banks, Netflix...).
>
> Is there a way that you can check if the message is authentic? Many service providers will also provide copies of notifications or other documents in your account page. For example, if the message is from Facebook, it should be included in your [list of notification emails](https://www.facebook.com/settings?tab=security&section=recent_emails), or if it is from your bank, you can call your customer service.

English 770 characters edited Current translation Read only

a year ago

Browse all string changes