A poorly written, plain text email requesting sensitive information arrives in your inbox from a sender you have not interacted with before. Without much thought you delete the email, writing it off as bogus.
Further down you come across an email with the subject: Update Your Account Information. In the sender column is your bank’s name. The HTML email is well formatted, using the colours, layout, font, and logo of your bank. The email states that as a security measure, you will no longer be able to access online banking unless you update your account information. Beneath this message is a hyperlinked sentence which reads, ‘Sign in to update your account information’. The email is signed from your bank’s customer service team.