Gone phishing!

I fear it's a fact of life that if you receive email you will receive junk mail of various types, ranging from the harmless but irritating to the downright dangerous: click at your peril!

Such things are very worrying for email users, because it can be very difficult to tell some of them from genuine emails. A sad but typical example has been documented by the BBC's Rory Cellan-Jones, who managed to avoid falling victim to a PayPal payment scam while he was auctioning in aid of the Children in Need charity.

As a recipient you should be able to detect such things by carefully checking any links in the email. (Ideally you shouldn't click on links in emails but, hey, this is the real world.) Usually, by hovering your pointer over a link you should be able to detect the actual address to which it goes, not what the visible text says. If you are more adept you can explore what are called the long headers of a mail to see where it really came from and how it got to you. But some emails are sent legitimately from web servers or other addresses that may not have what is called a mail exchange (MX) record.

I am not a fan of HTML emails but they are here to stay with all the potential for trouble from hidden links and tracking images. I feel it's rather like insisting that telephone calls are sung, not spoken, just because it's nicer. With a text email, it's up to the mail client whether any link text is turned into a real clickable link ... usually triggered by an 'http://'.

Why is this relevant to us as developers and producers of interactive media? I think we need to think carefully about how our clients communicate when using emails to contact their customers, especially if they are asking for information. Our clients are not all banks (or PayPal) so the chances of a scammer sending out emails purporting to be from our clients are slim ... but do their emails always seem to be clearly from them?

Let me give an example. You may use a third party to manage a mailing list for a newsletter. Have you checked to see how those emails actually arrive? The 'Reply to' header may show your domain but the real sender address will be the third party company. The unsubscribe links may be to the third party company. All this is completely above board and I only mention it because there are genuine instances where some of the basic sanity checks on scam emails will fail with the genuine article. To ameliorate this you could be up front about it and say that your mailing list is handled by another company, which will explain the different email domain.

PayPal and eBay have a good technique. They always address you by name whereas phishing emails tend to start Dear customer or even Dear friend. The UK National Savings will send you an email telling you that you need to log onto your online account and read a new message: not particularly friendly but very safe. It's useful to see what other organisations do to help keep their customers safe online. Definitely something that's well worth doing and, coincidentally, good for business.

The importance of being email

We're told (by Gartner Group) that 80-90% of an organisation's intellectual property is stored in or sent by email. That's an extraordinary amount. While an increasing amount of communication is using social networks email remains an important channel for a company, especially when you remember that email includes attachments. Might you need to produce them in a legal dispute, or if you want to sell your company? The longevity of email is notable as well, being just about the first mechanism for communication over the internet.

Do you archive your emails? And what does archiving mean in this context. I'm always reminded of the mysterious library in The Name of the Rose, where only the librarian knows how to find anything and the internal structure is kept deliberately obscure. Randy Murray's blog notes that organisation is just as important as preservation when it comes to archiving. (We might note that disorganisation can be a way of deliberately hiding something, such as a book placed on the 'wrong' shelf in a shop for later retrieval.)

Use of the Cloud quickly comes up in discussions about archiving. This isn't just for emails of course, but with tens of thousands of emails being received across some organisations archiving of emails isn't simply a matter of backing up a hard drive. Rackspace make a cogent case for Cloud archiving in their blog, and you might say "they would wouldn't they?". However, there are some useful thoughts in a video on the Computing web site. It's over ten minutes long but worth sticking with. One good point I noted is that while you might wonder how secure your data can be in the Cloud, have you thought through how secure it is on your premises?

Now go and check that back door.