whats the scam

But so few organisations use TFA. I'm not sure how it could be delivered by SMS though.

Lots and lots of these emails take you to a site which looks identical to the real one. The giveaway is always the URL.

Assuming you have an account at that bank or whatever, so in danger of being ripped off, simply check it is the same as the one in your address book.

For the few I get these days, I don't mind forwarding to a spoof@ address, if they have one. Paypal and Apple are the two most common.

SMS was the first method. You register your mobile with the website, and then, when you log in, it sends a code to your mobile.

The reason I specifically mentioned 2FA-by-app, is that there have been reports from the wild of SMS being rerouted or intercepted because of an insecure-by-design feature of the spec. Not that I would worry two much about that. However, much more likely is that the cretinous morons that work for the company would change the phone number registered to the account for the first Tom, Dick or Harry that calls up. Which is much more likely (I believe some TSB customers lost out this way).

Of course, being 2018, there are a plethora of authentication apps (I have to have 2, and Facebook has an inbuilt mechanism).

That said, there was a story a while back that the RSA keyfobs were compromised due to a leaked or misapplied key.

Or the spelling :)

Never follow a link - always type the URL in manually. You won't go wrong then.

I haven't used any like this. They either call me by phone or I need to use a 'secure key'.

You can also report it to InActionFraud too for all the good that will do.

Mostly they are phishing attempts to steal your login credentials with a few being links to hostile web content of some sort or an attach

You start the login. Give the first factor. You are sent a text with the second factor.

I use Google Autenticator. For two external things, and also for an internal one of my own (where I validate the Authenticator value).

You can do, particularly with the ones that exploit common spelling mistakes and domain errors. Makes more sense to have links on your own system. Some like Roboform automate that very elegantly and automate the logon and form filling too.

The link that may be displayed may well not be the link that will actually be followed when you click on it. Which is why I made my email client check whether these two are the same, and display a phishing warning when the displayed link is not the same.

Jim Ross explained on 16/06/2018 :

Firefox has a basic one built in, but there are much more sophisticated ones you can add to Firefox. You get into the habit of Firefox filling in your known passwords, such that you would have to look up the password if it didn't. It will not fill in your password except on the correct site, so it adds that layer of extra security.

You can get an even more capable password store/form filler as an extra for Firefox.

The risks are of the entire password store being hacked into, versus you inadvertantly filling in your password details on a spoof site if you only do such things manually.

Tim Streater formulated the question :

Outlook can do that.

In a decent mail clinet hovering the cursor over the link generally pops up the real URL...

I never reply to anything suspicious on my mobile because the android app is utter s*it...

Not possible with the ones that never keep that stuff off your system and encrypt it proper on your system.

Much lower risk with the first approach.

That's what I have implemented.

Doesn't your browser display the true URL when you go to any site?

Even that is not always obvious... they quite often take advantage of the ability to use 16 bit characters in the web names now, so they can register legit domains that render in characters that look very much like say paypal.com etc. e.g: