Reply-To
Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 27 of 43.
When you reply to an email, your reply does not always go to the address shown as the sender. An email can include a separate Reply-To address, which tells your email app where to send your answer.
For example, read this message:
seclab email m7Look for these lines:
From: Sam <sam@lumen.test>
Reply-To: desk@lumen-support.testThe From line makes it look like Sam sent the email. But Reply-To sends your answer to desk@lumen-support.test, which is not Lumen's lumen.test address. If the email asks for private information, that information would go to the other address.
A different reply address is a reason to investigate, not automatic proof of a fake. Some real services use one too. Compare it with contact details you already trust before replying.
Challenge
EasyTicket from Omar, finance
Two supplier messages are waiting. One asks for account information, but its replies would go to a different company. Inspect both messages. Remove the fake before I reply, mark it as phishing and keep the real supplier invoice available.
Try it yourself