Originally Posted by
Zorak
It may not be intentional, but poor grammar/spelling mistakes have been argued to be a feature, not a bug, of phishing/scam emails. i.e. people who notice these sorts of things and immediately have BS alarms go off, are not high-value targets because they're less likely to be fooled/convinced, whereas the sort of person who glosses over those errors and says "this seems legit" are exactly the sort of person they would like to try to scam.
Very true. The spearfishing attacks (the attacker is targeting a specific individual) are much better done and can be very hard to identify as fake. It all comes down to the reward/investment analysis.
Bottom line:
1) Do not click on a link in an unsolicited email
2) Do not open attachments if you are not expecting it--even if you know the person.
3) Always run as an unprivileged user on your computer (i.e. non-administrator)
4) Use a backup system for your data that has versioning (and you should be using the 3-2-1 backup strategy)