How AND Why to Provide Headers when Reporting Scam eMails:

A User Tip Authored by TheLittles of the Apple Support Community:

How AND Why to Provide Headers when Reporting Scam eMails:

Forward scam eMails as an attachment, and attach screenshots of its headers and the eMail message, in-full. Highlight important info (such as sender’s email Address and IP Address) and then take the screenshot. Send your eMail message to anyone who might interested in, or could have been affected by this eMail. Those can include, but are not limited to the following….

• Friends
• Co-Workers
• Web Masters
• Family Members
• Company being Spoofed
• Federal agencies like The FTC, and the The IC3(officially the FBI)

A. HOW to Provide Headers when Reporting Scam eMails:

Performing this in the macOS Mail App:

I. Reveal the Headers:

II. Take Screenshots of the Headers and the eMail Body, and Name Them Accordingly:

III. Attach the Screenshots:

IV. Send this eMail:

First...

I. Reveal the Headers:

Perform the Following:

1. Open: the Mail app
2. Open: the eMail message
3. Click: View menu
4. Hover Over: Message >
5. Select: All Headers (See Screenshot 1)*

*Screenshot 1:

then..

II. Take Screenshots of the Headers and eMail Body, and Name Them Accordingly:

a. Taking the Screenshots:

Received a scam eMail message from a sender of the icloud.com domain? If so, you can use screenshots to report in-depth contents for investigatory purposes. Attach Screenshots of Header Information.

Capture: a portion of the screen, and forward these screenshots to to reportphishing@apple.com

1. Maximize: the screen
2. Hold Down: command + shift + 4
3. Capture: these portions of the window

– the headers and

– the eMail message body

and...

b. Naming the Screenshots, Accordingly:

As you go about taking these screenshots, rename them accordingly (right-click, and select Rename). Rename these screenshots in a sequential, corresponding order. Then, take a screenshot of the entire message.

i.e. A Sequential, Corresponding List of Screenshots by Title:

– eMail headers screenshot 1.png

– eMail headers screenshot 2.png

– eMail message screenshot 1.png

– eMail message screenshot 2.png

then...

III. Attach the Screenshots:

Select your screenshot(s). For multiple, screenshots, Hold Down the command key as you select them.

1. Click: The right-tilted paperclip (See Screenshot 2)*
2. Select: Attach Files...
3. Select: [the file(s)]
4. Click: Choose button (bottom-left corner of window)

*Screenshot 2:

then...

IV. Send this eMail:

By forwarding this eMail as an attachment, all items will remain intact and retainable. Also, provide screenshots of your headers from beginning to end, and the eMail from top to bottom, for assurance-of-viewership purposes. The goal here is to get this investigated.

1. Open: the message
2. Click: Message menu
3. Select: Forward as Attachment (See Screenshot 3)*
4. Attach: [the screenshots]
5. Include a brief description of what this eMail is all about: Screenshots of to this eMail are attached containing icloud.com eMail imposter's scam eMail info.
6. Title the eMail: Scam email
7. Send: the eMail to all those applicable (i.e. abuse@[domanename].com)
8. The eMail's content will be reported

*Screenshot 3:

B. WHY to Provide Headers when Reporting Scam eMails: eMail Headers:

• For Investigatory Purposes and Personal Research:

In brief, the flow of data is virtually seen as it is sent from the sender's mail server and on to the recipient's mail server. IP Addresses and eMail addresses are being provided.

• Learn of your eMail Provider’s GUI:

If not using macOS Mail app, how to reveal these depends on the eMail Provider’s GUI (Graphical User Interface).  As for using the Mail app on a Mac, hold down the following keys: command + shift + H

• Formatting Makes it Clear and Concise: for the Recipient:

When reporting a scam eMail, forward the eMail itself as an attachment and attach it will keep the headers intact.  For assurance-of-viewership, you can attach screenshots of the headers along with the entire eMail file.  As you scroll down, take these screenshots in sequential, corresponding order, naming the accordingly. Highlight certain items (i.e. eMail Addresses and IP Addresses) to make your case in point.

• Become Wary of these Common Schemes:

– Security Software Suites (i.e. McAfee, Norton, and AVG)

– Finances (i.e. Lottery, Retirement Funds, and Investments)

– Benefits (i.e. Social Security, Public Housing, and Insurance)

– Politics (i.e. Voting, Polling, Donations, and Upcoming Events)

– Mailing Services (i.e. United States Postal Service, FedEx, and UPS)

– Driver Violations (i.e. Ticketing, Unpaid-Toll Charges, and Expiring Driver's License)

• Ability to Format Screenshots to Make a Strong Case in Point:

Having been forwarded as an attachment, the headers will stay intact. Being sent as an image, you can make a stronger case in point by reporting it in your own format (i.e. highlighting and underlining words in the screenshot).

• Example of Screenshot of Headers:

(burred-out for privacy concerns). The light-blue is highlighted info of the sender):