Scamdemic Series: Online Phishing Scams Flourish During Coronavirus Pandemic

//  Leave a Comment

Welcome to the first installment of our new Scamdemic Series.  Each week I am going to deep dive into one type of scam making the rounds during the global Covid-19 pandemic. We’ll talk about how the scam works, who scammers are targeting, and how to avoid becoming a victim.

First up, we’re going to talk about phishing—and no I’m not referring to how fans of the psychedelic jam-rock band Phish zealously ponder the meaning behind the band’s set list choices or wax nostalgic about the first time they saw drummer Jon Fishman’s vacuum solo. Phishing scamsters are way more of a problem. 

What Phishing Scams Are

Phishing scams are emails, texts, spam, phone calls or websites disguised to look or sound like they are legitimate or trustworthy. In reality, cybercriminals are behind these scams and they are designed to trick you into giving up your personal and private information.

According to a cnbc.com article, coronavirus-related robotext scams are becoming more difficult to decipher. “It starts with a text purportedly from the Internal Revenue Service asking to confirm information for a stimulus payment through a link,” the article says. Clicking on the provided link takes you to an authentic looking IRS webpage where you are asked to enter your name, contact information and Social Security number.  Once the scammers have all the information they need, you are rerouted to the real IRS website where you may remain unaware that you were phished out of your sensitive information.

Scammers can be very nuanced in the use of phishing attacks. Understanding that a large segment of the population relies on home delivery of goods during the pandemic, scammers have designed emails and texts purporting to provide information on the delivery of packages. In this version of the scam a customer, eager to know the status of a package, may not think twice about opening an email claiming to come from FedEx. But by clicking on the link, a customer may inadvertently provide his or her personal information to a scammer or download malware. 

In mid-March, emails claiming to be from the World Health Organization (WHO), a leading health organization in the fight against the coronavirus, were sent out to the unsuspecting public. The emails included various attachments providing guidelines and recommendations for protecting against Covid-19 and staying safe during the pandemic. The real purpose of these emails was to lure recipients into downloading malicious attachments, including an invasive keylogger called Agent Tesla capable of stealing passwords, logging keystrokes, and capturing screen and video from your device.

The above cases are just a few examples of the phishing scam scene today. And, unfortunately, phishing scams come in many different shapes and sizes. In reality, they are only limited by the imagination of the scammer.  What is worse, the coronavirus pandemic has seemingly opened the phishing scam floodgates. In an April 16, 2020, Google announced that in one week they saw 18 million daily malware and phishing emails related to Covid-19. This is in addition to the more than 240 million coronavirus-related spam messages sent to users on a daily basis. Luckily, Google says they have security protocols in place that “block more than 99.9% of spam, phishing, and malware from reaching our users.”

Still, there are measures you can take to further protect yourself from these bad actors.

What You Can Do

Screenshot of the smishing scam Rocky received while working on this piece.

Educate yourself on the latest tactics used by scammers: The more aware you are of how scammers operate and the current type of scams they are engaging in, the greater the chances you will recognize a phishing scam coming your way.

Personal experience can back this up. At the time of writing this post, I was sent a phishing text (known as smishing) thanking me for the purchase of a $469.97 product. Admittedly, there was a strong impulse to find out, as quickly as possible, what it was all about and click the conveniently provided link. The scammers behind this text were banking on the shock of seeing the dollar amount to spur me into taking some misguided action. I might not have been able to resist the urge to click on the link if I wasn’t familiar with some of the techniques used by scammers. Instead, I calmly verified directly with my bank if any unauthorized payments had been made. When I was assured none had, I simply deleted the text and moved on with my day.   

Be vigilant and pay attention: Treat texts and emails you receive from unknown sources as potentially suspicious,  especially if they are unsolicited. If you receive a suspicious email/text, do not reply, open any attachments or click on any links. Instead, contact the business or organization directly and verify with them that they sent you the email/text. If the email or text is from an unknown source, think hard before going further and clicking on any links. The best course of action may be to delete these types of communications. If you want to respond to an unsolicited email, you can rely on websites like CheckPhish—a free url scanner that verifies whether the site is known for phishing—before performing any call to action.

Take note of the language used in emails and texts. Emails that are purportedly from a reputable business but are overly friendly should raise some flags. If they begin with: “Hello Mate” or “Hi User!” steer clear of them—they are likely scam communications. Egregious grammatical and spelling errors are also a strong sign a scammer is working behind the scenes to dupe you into divulging sensitive information.  

Up Next

In the next blog post, we will look at how scammers have set their sights on your government coronavirus relief payments. For many, stimulus checks represent a lifeline in times of economic uncertainty but for cybercriminals they are just another opportunity to enrich themselves at your expense.

Covid Cons: Introducing the New ‘Scamdemic Series’ Spotlighting Coronavirus-Related Cons And How to Avoid Them

//  Leave a Comment

Covid-19 and the New Wild West 

Imagine you are driving to town to restock on essentials. As you are driving, you see cars lining up under a white banner advertising, “Covid-19 testing here.” You wonder if you may have the coronavirus because you haven’t been feeling well lately and so you decide to get tested. 

It strikes you as odd that the operators of the testing site prefer a cash payment of $240 or that their personal protective equipment (PPE) has that signature DIY-flare. In a world where every new day brings in a “new normal,” it’s easy to lose sight of what normal actually looks like. 

You hand over the cash, get your throat swabbed and go home and wait for test results that will never be sent to you. You don’t know it yet, but you have become a victim of a new crop of coronavirus-themed scams. 

Businesses May be Closed but the Business of Fraud is Booming

The coronavirus pandemic has been a deterrent to the ordinary criminal—drug dealers, murderers, rapists, burglars, and their ilk—those who, under normal circumstances, have to leave the house in order to commit crimes. After all, a burglar usually waits for you to go out before helping himself to your things. For the scores of fraudsters and online criminals out there, however, this prolonged stay-at-home life has been a bonanza. According to the Federal Trade Commission, during the first three and a half months of 2020, Americans reported losing $13.44 million to Covid-19-related scams, while Canadians have lost $1.2 million in the last several weeks, alone.

In an effort to help arm our readers with the knowledge necessary to protect themselves from the growing number of pandemic scams out there, we’re putting together new series here on the blog called Scamdemic. Each week we’ll focus on a different scam born out of the global coronavirus pandemic, giving you the high-level overview of how these cons work, as well as tips on how to best protect yourself from them. 

In the meantime, here’s a quick list of covid-related cons that have been in in the news recently:

  • Phishing attacks: As we continue to isolate at home, we rely more than ever on the internet for work, essentials and entertainment. Scammers are taking advantage of this new reality by using phishing scams—which use emails, texts, spam, or websites to steal sensitive, personal information. Last month the Better Business Bureau released a report highlighting a number of “free trial” offer scams making the rounds during Covid-19, including one claiming to offer free Netflix streaming services. 
  •  Investment scams: Investment scams can be particularly enticing when they play off of what’s happening in the news—the search for a vaccine, PPE shortages, new testing technologies, etc.—luring victims into thinking an investment is guaranteed to bring in a good return.  Unsurprisingly, investment scams are on the rise during the pandemic. Last month Maryland’s Attorney General warned of an expected surge of coronavirus investment schemes, and the BBB published a “scam alert” on a new pyramid scheme making the rounds on social media.
  • Healthcare-related scams: PPEs, medical devices and other necessary items are in short supply these days.  Plenty of scammers are pushing fake and defective products or marking up prices on supplies. Don’t think you can fall for one? Even governments are susceptible to these scams—scammers conned the German government out of some $34 million in relief money meant to help its citizens, Forbes reports.
  • Stimulus checks and government impersonation schemes: For many people, stimulus payments represent a financial lifeline during these uncertain times. The U.S. Treasury Inspector General for Tax Administration (TIGTA), the agency responsible for deterring fraud related to Internal Revenue Service (IRS) programs and operations, “anticipates that criminals will engage in various scams and schemes in attempts to intercept EIPs (Economic Impact Payments), and/or steal sensitive taxpayer information during these challenging times.” These schemes include fake websites, emails or texts claiming to be from the IRS asking for personal, sensitive information so that scammers can steal your stimulus checks from you. 
  • Employment Scams: Many people are looking for online work while they wait for the job market to rebound from the pandemic shutdowns. In some of these scams, fraudsters may require an upfront “training” fee, ask that you provide personal and banking information to run a credit check or set up direct deposit payments, or send you a check to buy hardware and supplies from “approved vendors,” only to bounce the check and pocket the profits on the purchases the new hire made.  
  • Small Business Scams: As governments allocate millions of dollars to help businesses stay afloat, scammers are busy trying to divert these funds into their own pockets. Stay ahead of them by understanding some of the ways they can get their hands on your money before you do.
  • Charity Scams: People have fallen under unprecedentedly hard times—Covid-19 has had historic impact around the world— and many who are in stronger positions to weather the economic fallout want to do their part to help those less fortunate. But before giving your money away be sure that your charitable donations are really going to help those in need.

Up Next

In the next blog post, we will be taking a closer look at one of the most deceptive and effective ways that scammers steal sensitive and personal information from victims—phishing attacks. Phishing attacks are emails, texts, and other forms of communication that appear to come from sources that are trustworthy and reputable—when in fact they are anything but trustworthy.