Careful with this “legitimate” e-mail

Francisco Fernandez — Fri, 30 Oct 2020 13:43:16 +0000

As the pandemic progresses, hackers have found more and more opportunities to steal your personal information through e-mails that combine a “legitimate” look with people’s personal situations during this crisis. Don’t fall for it. Keep reading.

Your government is looking for you, or is it?

As we’ve covered in this space before, phishing is the practice of using legitimate looking e-mails to trick you into giving up your personal data, be it your passwords, bank account numbers, or any other useful data for hackers to either steal your money or sell it to other nefarious characters or groups. This is extremely common, as hackers attempt to steal your Apple ID or Paypal information or bank account. Most of those look exactly like the company e-mails, but as we’ve all smarted up to their scheme, they needed to find new e-mails to trick us.

We’ve seen the “Correos” or postal service “facturas” (invoices) before, but now, they’ve added all sorts of government agencies to their arsenals, and the number has been increasing exponentially. Here are some examples:

We've seen it all before, and we'll see it again

These are just some examples of these. We’ve blocked the images and only added where we knew the logos were, but the full versions look even better and more tempting. Some are better than others at fooling you, and though these are from Spain, they’ll include whichever country you’re located in. Most government e-mails aren’t pretty, and because of the information presented, depending on someone’s situation, they might easily fall for it and click. From there, a “legitimate” looking website will be happy to steal your information.

Some of these might seem harmless. They might only take your “address”, but when you consider that most of our private information is out there on the internet in some form or another, your “address” might be the missing piece of information for a hacker to piece all the parts together and have the data needed to empty your bank account. It might be as simple as stealing your identity to get some credit cards, destroying your credit in the process. They could even use your data to commit criminal acts or access illegal or nefarious websites.

Remember that, even if innocent, sometimes the mere appearance of guilt is enough to scar you forever.

The covid-19 crisis has only made it worse

Opportunists are always around and ready to take advantage of people, sometimes positively, but mostly negatively. Now, in these particular cases, most of the addresses hidden behind the buttons have been “.ru” addresses, which means they come from Russia, but we’ve seen them from lots of other countries as well.

Don’t let these criminal hackers take advantage of your personal, pandemic crisis, be it a fine for breaking curfew or not wearing a mask, or a late payment or defaulting of a loan, or other legal situation. Don’t let them fool you into giving them your data simply because you’re in a tough spot right now. Don’t fall for it, and in fact, you can fight back by reporting the e-mail to the company or agency they falsely claim to be or even to the police.

Most companies have a “report phishing e-mail”. Search for the company and the words “report phishing” and go to that company’s website and follow the instructions to report it. If it’s a fake government e-mail, you can report it to the “Guardia Civil” or your country’s police department. Most likely they’ll ask to “Forward as attachment” to a specific e-mail.

And remember: Don’t download the images, don’t click, most definitely DO NOT OPEN the attachments, and once reported, delete the e-mail and if you sent a report, the sent e-mail as well.

Good luck and stay safe online and off, during this pandemic and beyond.

The post Careful with this “legitimate” e-mail appeared first on Francisco Tomas Fernandez.

Don’t fall for the most common Covid-19 pandemic scams

Francisco Fernandez — Wed, 22 Apr 2020 07:59:00 +0000

Like any crisis, the Covid-19 pandemic is full of opportunists. Some are legitimate and are simply serving a market necessity, but others are taking advantage of the fear and confusion to up their scam game in order to steal our money.

Phishing looks like fishing, but isn't

We’ve all seen the e-mails. They look legitimate, almost perfect, but there’s usually something missing. Maybe it’s your name, or there’s lots of typos, or the logo is wrong, but it’s not quite Paypal or Apple or Amazon or Citibank. Still, many are so accurate that they can easily fool us into thinking they’re the real thing.

This is the problem with phishing scams, and during this Covid-19 pandemic, as companies scramble to react and communicate their plans to clients, providing special websites, and other tools to assist in managing the situation, we’re bombarded with e-mails that are not the usual company fare. That’s where the scammers are at their best, taking advantage of our confusion to aid us in misleading us towards their scam.

Got an e-mail from “PayPal” or “Amazon”? Don’t click on the links. Go directly to your browser and type in the URL. There’s a “Security Issue”? Contact your bank directly or again, go to your browser and type the bank address yourself.

Clicking on these links often take you to a website that looks real, except maybe a slight typo in the address or they’re using a subdomain to sow confusion. Don’t do it. Don’t click. Don’t open that attachment.

Social Engineering isn't what it sounds like

It sounds like some government plan to modify our behavior, and the Covid-19 pandemic can lead us down some dark, conspiracy holes. But no, social engineering in the context we’re talking about is a clever way to fool you into divulging personal or confidential information. It’s a con tactic.

Often used by phone, the scammer will use social engineering to get more information out of you than you would normally have given. During this crisis, this type of technique has grown in use along with simple impersonation to steal people’s personal information, identity, credit cards, bank info, etc.

Never give any of your personal information over the phone. Make sure you know the number calling you, and if it’s an offer, call the company yourself using their public number, not the one the caller gives you.

I know who you are... who are you?

Often, it’s easy to trust a scam. They seem to know your information, the same as a legitimate company would. They might ask for you directly, reference something personal, maybe a password even. Don’t fall for it.

Hackers have been growing in their information gathering activities, breaking into companies that hold all our information, like credit score companies such as Equifax, or data brokers. They either use that data to scam us directly and maybe even tempt us into a ransomware game, where we pay them in bitcoin to avoid losing all our data or avoid embarrassment, or they may sell our information to others who will use it to scam us into giving them money.

In the latter situation, the scammer will offer to confirm your information in order to ensure the data they have on you is valid, marking it as something to be used for social engineering with a bank or other company, identity theft, etc. If they have your info, they don’t need to confirm it, so don’t.

Always, call the company or bank directly using their publicly available number or website. Don’t fall for these scams during the Covid-19 pandemic or beyond. Stay safe!

The post Don’t fall for the most common Covid-19 pandemic scams appeared first on Francisco Tomas Fernandez.

Phishing Archives - Francisco Tomas Fernandez