Features Of Email Scam Campaigns
Easy to target a large number of people at once
Dollar amounts lost tend to be smaller (tens or hundreds of dollars, not thousands or tens of thousands)
Much in common with generic phishing emails, but not always precise overlap
Good for conveying scams that need a lot of explanation
Good for conveying scams that need an attachment as part of the bait
Good for conveying scams that need to visually impersonate a bank, company, etc.
In order to engage the victim, the Email "bait" must have a call-to-action
Entice the user to click or copy a link to launch a website
Convince the user to reply to the message
Convince the user to initiate a call-back via phone
Convince the user to open an attachment
Indicators For Email Campaigns
Scams that have these indicators are conducive to distribution via Email:
Spray And Pray / Scattered: The scammer approaches many victims at once such as through bulk email or SMS.
Semi-targeted Regionally: The scammer approaches people in a certain region, for example by area code (toll scam) using semi-targeted email or SMS.
Semi-targeted Collection: The bait (initial reachout) is sent out to people in a collection harvested online, for example from some data breach or corporate directory.
Detection Notes
The reply address is easily seen by the user
The mass-produced nature of these messages makes them easily detectable by spam catchers