Monday mornings are hectic. You are juggling coffee, unread emails, and meetings. The cyber crooks know this and they love it when you move too fast.

Their favourite trick? Tiny changes to email addresses that most people never notice.

One quick reply or click and you have played right into their hands.

👀 Why Do Phishers Change Email Addresses?

Cybercriminals want you to act before you think. They know if you are tired, distracted or rushing, you will not spot a missing letter or a clever swap. That is how they make fake emails look like the real thing, hoping you send cash, data, or passwords their way.

🕵️‍♂️ How Do They Do It? The Sneaky Tricks Explained

Check out these real-world moves scammers use in South Africa and around the world:

🔤 Swapped Letters or Numbers

• From: accounts@bigcompany.co.za
  Phishing: acc0unts@bigcompany.co.za (zero instead of “o”)
• From: payroll@mybusiness.co.za
  Phishing: payroIl@mybusiness.co.za (capital “I” instead of lowercase “l”)

➕ Extra or Missing Characters

• From: supplier@trustedpartner.co.za
  Phishing: suppliers@trustedpartner.co.za (extra “s”)
• From: hr@company.co.za
  Phishing: hr@companny.co.za (double “n”)

🌍 Wrong Domain Ending

• From: info@saferisk.co.za
  Phishing: info@saferisk.com (“.com” instead of “.co.za”)
• From: admin@jhb-logistics.co.za
  Phishing: admin@jhb-logistics.net

🪄 Lookalike Domains

• From: finance@myfirm.co.za
  Phishing: finance@myf1rm.co.za (number “1” instead of letter “i”)
• From: hello@capetowntravel.co.za
  Phishing: hello@capet0wntravel.co.za (number “0” instead of “o”)

🕳️ Hidden Punctuation or Spaces

• From: support@fasttrack.co.za
  Phishing: support@fast.track.co.za (sneaky extra dot)
• From: orders@retailhub.co.za
  Phishing: orders@retailhub .co.za (added space)

🏠 Added or Changed Subdomains

• From: admin@securebank.co.za
  Phishing: admin@securebank-support.co.za
• From: ceo@bigbiz.co.za
  Phishing: ceo@alerts.bigbiz.co.za

🤔 Letter Swaps That Fool the Eye

• From: it@trustgroup.co.za
  Phishing: lt@trustgroup.co.za (lowercase “l” instead of “i”)

⚠️ Why It Matters: Real Consequences

These tiny changes have led to real disasters for businesses in South Africa:

• 💸 Money sent to fake suppliers or “employees”
• 🗂️ Confidential data landing in the wrong hands
• 🧑‍💻 Account credentials stolen and used for bigger scams
• 🤯 Long days, big headaches, and broken trust

No one is too clever or too careful if they are moving too quickly.

✅ Your Quick Checklist to Outsmart Email Phishing

• 🔍 Check the sender’s full email address every time
• 👁️ Look for extra, swapped or missing letters and numbers
• 🛑 If the request is urgent or for money, confirm by phone
• 💡 If anything feels off, double check before you click or reply
• 🖱️ Hover over links to see where they really go
• 💬 Report any strange emails to your IT or cybersecurity team

💡 How to Make Mondays Safer

Train yourself and your team to slow down, especially at the start of the week. Remind everyone that most cyber scams only succeed when people are too rushed to pay attention.

Let the Hackerstopped EDR team watch your digital back while you get on with your real work!

Seen a sneaky fake email or worried your team might miss the next one? Please send us a message at protect@hackerstopped.com.

We help South Africans outsmart the cyber crooks—one email at a time.