Pilot preview. Entries marked Sample are illustrative and haven’t been technically reviewed or signed off yet.
The Haven Field Guide
Library
Every entry, organised by what you’re trying to figure out, not by when we wrote it.
Way in
Type
Topic
3 entries
- Threat dossierHow does browser-in-the-browser phishing work?The page draws a fake sign-in pop-up, address bar and all, using ordinary HTML. Because that "window" is part of the page, you cannot drag it outside the browser tab, which is a quick tell.
- Threat dossierIs that email or text from the IRS real?Almost certainly not. The IRS doesn't start contact by email, text or social media to ask for information or payment; it sends letters. Refund or back-tax messages that arrive digitally are scams, as are fake tax-software sign-in emails. Type irs.gov yourself.
- Threat dossierIs that party or event invitation email a scam?Often. Fake invitations imitating services like Evite, Paperless Post or Punchbowl ask you to sign in with your email password to view them, or to download a "viewer" that is really remote-access software. Real invitations never need your email password.