Phishing and social engineering attacks are among the most common forms of cybercrime. Such attacks largely depend upon the target taking specific action, such as visiting a malicious website, downloading a malicious file, or inadvertently disclosing sensitive information.
But what if you receive a phishing email, and you do not click any links or download any files from it? Can you be hacked from opening an email?
Can You Get Hacked From Just Opening an Email?
It is technically possible for a cybercriminal to encrypt an email with malicious code, meaning that just opening the email, or even accessing the preview pane, could change your system settings, or trigger a download. However, nowadays, email service providers use a number of systems to prevent any unauthorised access to your personal settings or your operating system.
Modern email systems simply display static text and images with no live scripts or executable codes.
Just opening an email, even if the email itself contains malicious code, should not cause you any issues.
This means that, in order for a phishing or social engineering attack to work, the cybercriminal needs you to take certain actions.
How Else Can You Be Hacked By Email?
The actions a cybercriminal would want you to take would be to access a certain website, or fill in a certain form, or download a certain attachment. Any of these could allow them to install malicious software on your device, which will leave you vulnerable to data breaches, ransomware attacks, or other forms of cybercrime.
How Email Providers Keep You Safe
- They display emails in a restricted environment which will display a message’s text and images while preventing any embedded codes from interacting with your device and its files. This is known as sandboxing.
- They block external images as standard, or they route them through their own secure services. As the images do not load automatically, no files are downloaded to your device, which prevents the cybercriminal from getting backdoor access to your system.
- They scan all potential messages for any red flags, including malicious code or links to known phishing sites. This means that any serious threats are caught and contained before they even make it to your inbox.
Just Because You Cannot Be Hacked From Opening an Email, It Does Not Mean That There Is No Danger
What Information Can Be Gained From an Opened Email?
So, cybercriminals cannot hack your system or access your personal data if you simply open a phishing email. Yet opening a suspect email could still lead to privacy risks, and even leave you more vulnerable to identity theft.
It is possible to embed tracking pixels in emails. These are tiny graphics that are literally the size of a single pixel. They can be transparent, which makes them totally invisible to anyone who is not actively looking for them.
Businesses can use these tracking pixels to measure the reach of their marketing emails. Unfortunately, cybercriminals can also use them in order to gather certain information about you.
This information will be limited. Often, all they can see is your location (via your IP address), along with the type of device you used to access the message, and the time at which you accessed it. And crucially, if they can gather this information, it confirms that your email address is active, and that you will actively engage with certain types of content.
In the long-term, cybercriminals could use this information to build a profile of you. They will come to understand your habits, and they may ultimately learn what sort of messages are most likely to get your attention.
So, eventually, these cybercriminals may catch you when your guard is down, meaning that you will unwittingly take that necessary second step: Clicking a link, or downloading a file.
Opened A Malicious Email? Don’t Panic!
As we have seen, simply opening a malicious email is not likely to compromise your device or your data. And if doing so exposes you to any future privacy risks, you will be safe so long as you stay vigilant, and so long as you never click any links or download any attachments in any future phishing emails.
There are a number of steps you can take and habits you could adopt if you opened a phishing email and you are concerned about future cyberattacks:
- Change your passwords, using a reliable password management system if possible. This will automatically and routinely create secure new passwords for any online service you use.
- Use multi-factor authentication wherever possible. This means that, instead of simply using a password to access a system or service, you will also use additional credentials such as a pin, a one-time-access code, or even biometric information.
- Get a good antivirus system, which will automatically detect if any unauthorised malicious scripts attempt to run on your system.
- Stay on top of system updates, and keep your web browser, your email provider, and your antivirus system updated too. The latest updates will include the latest security features, with fewer loopholes or backdoors for cybercriminals to exploit.
What To Do If You Clicked a Link or Downloaded an Attachment From A Phishing Email
It is important to act quickly:
- Disconnect from the internet, and turn off your device’s wi-fi. Wait a few minutes before you go back online. And before you connect again, tell your device to “forget” the wi-fi network.
- Change all passwords you use to access any secure online services, and make sure the account recovery information is still correct.
- Run an antivirus or malware scan on your device.
- Get in touch with your bank, and ask them to monitor for any suspicious activity.
- If you are using a device that belongs to your business or your employer, notify their IT or cybersecurity team immediately.
Specialist Cyber Insurance – An Essential Line of Defence
As well as covering your liabilities during a cyberattack, cyber insurance can also cover certain expenses associated with your response, including the costs of notifying clients or customers whose data may have been compromised by a breach.
Read our full guide to how cyber insurance can help protect your business.
James Hallam is an independent Lloyd’s broker with access to a hand-picked selection of A-rated insurance providers. We can help you find the cyber insurance you need at a competitive price.