How can I tell if an email from a bank is legitimate?

I got a notice supposedly from my bank telling me there was a problem with my account. I have heard of email scams related to banking — so how can I find out if this request is legit?

Practice safe banking

I’m going to go ahead and open with this, for your safety and everyone else’s who reads this: The number one, most foolproof, and easiest way to verify that a request from your bank is legit is to call your bank and ask them. Don’t call any number in the email. Call the one on the back of your debit/ATM card.

Having said that, with the number of emails we get daily from our various financial institutions, this can be a troublesome and time-consuming solution for every one of your “Your statement is ready to view” emails. So how to tell if it’s the real deal? Read on.

Don’t go for the phish

Microsoft has an excellent primer on fake emails — called phishing – and how to spot them on their site, and I highly recommend taking the time to read through the whole thing. I will go ahead and hit the highlights.

Things to look for:

Requests for personal information via email: The majority of legitimate businesses have a policy where they will never ask you for sensitive information via email.

Urgent wording: Using a pleasant tone but warning you of dire consequences if you don’t respond immediately with personal information. These emails are almost never personalized with your name, but use language such as “Dear Valued Customer” or similar.

Fake links: Sure, the link in the email reads as “bankofamerica.com” — but when you hover your mouse over it without clicking, the little popup box reads “come.to/scam/yourmoney” or somesuch. Also, look for misspellings in the URL. Does that say “wellsfargo.com” or “welllsfargo.com?” Don’t click on any link in a suspicious email. Type the bank’s URL into the browser manually and verify.

Message body is an image: Fake emails often use this tactic to evade spam filters.

Attachments: Many phishing schemes will ask you to open an attachment. In most cases, this is a virus that is either a data miner, a keylogger, or both. If you’re really curious, download it first, then scan it with your antivirus software. It will probably tell you to drop it like it’s hot.

Promises that seem too good to be true: Because they usually are.

Phishing scams aren’t limited to spoofed emails from banks, PayPal, eBay and even the IRS all offer information to help stop the kinds of spams you’ll find specific to their sites.

You can also check out your own bank for their insight into phishing — the latest scams they’re seeing and their advice for protecting your accounts. The direct links for a few banks: Wells Fargo, Bank of America, Capital One and Chase. Also check out some official government resources from the FDIC and the FDC.

The good news is, armed with some knowledge, common sense and caution, it’s easy to avoid these scams and schemes, no matter how sophisticated they are. To quote an old Russian proverb, “Doveryai, no proveryai.” In other words, “Trust, but verify.”