Phishing, vishing + smishing

In a recent post, I highlighted the threat of a recent phone scam involving the HMRC, in this blog post I’ll give you more of a breakdown of phishing, vishing and smishing and give you some examples of how cyber criminals will try to fool you in attempts to gain your details.

phishing

Similar to the art of fishing which is defined as ‘the activity of catching fish, either for food or sport’, phishing is the cyber equivalent where criminals actively try to ‘catch’ your personal information by using deceptive social engineering techniques in the hopes of gaining access to your accounts both personal and financial.

Phishing is carried out via email to obtain sensitive information or data. This is done by spoofing (faking) the email to look like it’s come from a trusted source but with subtle differences. These emails are designed in a way to make you click a malicious link which would take you to a fake website created by the criminals in the hopes that you enter personal information or allow the criminals to install malware (malicious software which could freeze your system or lock your files as part of a ransomware attack).

How does phishing work?

The two main methods criminals use in phishing attacks are links to malicious websites and including malicious attachments. Usually, malicious links will take you to cloned websites of ones you are very familiar with and the malicious attachments usually have ‘click bait’ names such as ‘INVOICE’ which then install malware on your device when opened.

Below is a picture I have taken from the brilliant http://phishing.org which highlights some red flags if you think you have received a phishing email. I have also attached a couple of examples so you know what to look out for.

COVID19 GRANT PHISHING EMAIL

scam email with link to phishing website

paypal phishing email

4 things to look out for

1. Legitimate companies will usually address you by name.
2. Legitimate companies will not ask for your sensitive personal information over email.
3. Phishing emails are riddled with spelling mistakes.
4. Hover your mouse over any link to see the destination of the URL.

VISHING + SMISHING

Vishing and smishing have the exact same concept of phishing but are just two specific ways in which criminals will try to steal your information.

Vishing is the fraudulent attack of making phone calls or leaving voice messages in the attempt to get victims to reveal personal information such as bank details and credit card numbers. During a vishing call, criminals will use social engineering techniques to get you to trust them and believe they are who they say they are. They will often spoof their phone number, so it looks like it’s coming from the official business it’s pretending to be. The most common vishing scam is vishing banking. These scams involve a call from someone who says they’re from your bank and that there is problem with your account or with a payment, they will then ask you to transfer funds to a different account to fix the problem. One of the most recent vishing scams is the HMRC tax fraud scam which I wrote about in my last post. 

Smishing is the fraudulent attack that uses misleading text messages to trick victims into giving your private information via a text. Smishing is the same scam as phishing and vishing but the criminals just use text messages in the hopes that you’ll trust this form of communication more. These text messages again may include links which will take you to cloned webpages asking you to input usernames, passwords, and credit card details. 

Below are a few examples of smishing attempts.

Final thoughts

Since the start of the coronavirus pandemic more and more of us have been victims of phishing attacks. This is due to criminals taking advantage of our new work from home lifestyle, we are more susceptible to these scams as we are making more calls than before, reading more emails, and generally communicating digitally a lot more than if we were still working in the office. Unfortunately, pandemic or not, criminals will take advantage of their victims in any way they can to benefit financially. Hopefully, this blog post has highlighted some of the things to look out for and will hopefully make you think twice before you click on that email from Amazon with your £1000 gift card (insert side eye emoji here). There are so many incredible resources just a google click away when it comes to phishing scams, many large businesses are aware of them and have their teams dedicated to dealing with phishing scams. 

Also a big thanks to Alex @ItsArtBabes for the awesome animation at the top of this blog.

New blog posts every Wednesday and Sunday.

M.

HMRC VISHING SCAM AND HOW TO AVOID!

It’s 08:19am on a Saturday morning in early Febuary and I wake up to three missed calls and three voicemails from a number I don’t recognise. Now I never listen to my voicemail messages but something told me that this morning I should check them out, clearly who ever called me was desperate for my attention so the least I can do is listen to what they have to say right?

So I access my voicemails and listen to them each in turn, all with the exact same pre recorded message:

“This is the HMRC, a tax fraud case has been filed against your name and unless you pay the amount requested an arrest warrant will be made against you, please press 1 to speak to an advisor”

Now i’m barely awake at this point but even I know something doesn’t feel right, I reverse search the number and realise this is the beginning to a vishing scam that is currently sweeping the UK but before we go any further there’s a few things you need to understand…

What is a vishing scam?

A vishing scam is a type of phishing attack where criminals will call you posing as a bank staff member or other financial service employees and try to get you to share your personal information over the phone, they will use social engineering tactics to persuade you to reveal personal details which will allow them to access your accounts.

But what is phishing? In a nutshell, phishing is a cyber attack that criminals use by using disguised emails as weapons to gain your personal credentials by tricking you into believing the email is from a legitimate source. The criminals spoof (fake) their email address so it looks like its coming from a trusted source, set up fake websites to look like the originals and use slightly modified URLs to direct you to a site created by the criminals in the hope you will provide them with your personal or financial information.

“Someone mentioned smishing is that the same thing?” – Absoloutely! Smishing is the equivalent to phishing and vishing but the criminals use text messages in order to try and steal your information.

THE hmrc scam

So what exactly happens in this scam?

Well it starts pretty much the same for everyone just how I described above. You’ll get a call from a mobile number that you don’t recognise and even sometimes the criminals will spoof their number to make it look like the official HMRC number. You will then have the pleasure of listening to that lovely pre-recorded message explaining that you will shortly be arrested unless you pay the money you owe and to press 1 to speak to an advisor. Pressing 1 transfers you to an ‘HMRC representative” aka the scammer. Now vishing scams are no simple feat and there is usually a highly complex criminal web with multiple people involved who may seem highly convincing. The representative will then proceed to tell you the accusations against your name and even provide pdf documents as if to seem legit, they will then ask you for more details and to start transferring money now as you’re on a timed call and the money has to be paid ASAP. (Some victims have said that the criminals told them the police were on standby 30minutes away and if they didnt pay within that time frame the police would arrive at their address). They’ll ask you to start transferring money in small amounts to different bank accounts as this makes it a lot harder for your bank to track the routes that the money takes.

Now you’re probably sat there thinking, “yeah i’d definitely know this was a scam and i’d hang up”, well lucky you but these calls can be highly intimidating and when you’re under pressure you can make extremely rash decisisons.

As the call progresses the questions get more personal in the hope you’ll reveal more information that is useful to the criminals until they’ve taken large amounts of your money and left you broken both financially and mentally. It’s intense and they will target anyone. Young or old, global pandemic or not.

I’ve been victim to one of these calls what should i do?

Well first of all you need to know that:

HMRC will never send an email, text message (or message in an app such as WhatsApp) or give you a phone call which:

• tells you about a tax rebate or penalty
• asks you for your personal or payment information

Next you need to report the call to the official HMRC phishing team

Final thoughts

hang up like it’s 2004 and you have a flip phone

Now I come from a performing background where I was registered as self employed and very rarely had anything to do with the HMRC unless it was to fill out my self assessment form. The rest of the year I never thought about taxes or any money I needed to pay them. I have many friends in the same position as me and to be honest the knowledge of paying taxes isn’t something i’ve ever been taught. Being a performer you often live from job to job and money is tight, so to receive a call like this without my cybersecurity knowledge, I would be scared. Taxes aren’t a thing that we ever learnt at school and more likely than not, if you get a call from the government saying you owe them money you probably will think that you do. Unfortunately the criminals don’t care. They will target anyone and right now there are a lot of vulnerable people that will fall for this scam. So I ask you all to share this post and talk to your friends about this, spread the word and make sure when you answer that unknown number and that pre-recorded message starts to play you hang up like it’s 2004 and you have a flip phone.

M.

Links for HMRC phishing page & ActionFraud:

https://www.gov.uk/report-suspicious-emails-websites-phishing/report-hmrc-phishing-emails-texts-and-phone-call-scams

https://www.actionfraud.police.uk/