121 Brands Impersonated in Massive 91-Country Survey-Turned-Fraud Scam
With an estimated take of over $80 million a month, this scam uses new evasive tactics designed to make detection and investigation of these attacks difficult at best.
Who doesn’t want to win a prize from a legitimate company for doing little more than filling out a survey? Seems easy enough and not dodgy at all, so why not? And when the prize is an expensive Samsung or Apple mobile phone, it’s even more of interest, right?
This is exactly the premise of a new scam outlined by security researchers at Group IB. In this survey scam, victims are made to think the survey is from a well-known business.
Source: Group IB
What makes this scam interesting is some of the work done behind the scenes. Using a technique Group IB calls “traffic cloaking”, the scammers use a series of multiple redirects to first gather information about the victim, their session, time zone, country, IP address, etc. This information is used to create a landing page tailored for the victim. In the example above, notice how the question is about a specific Internet provider – no doubt, the scammers have used the victim’s IP address to identify their ISP and are using it as part of the survey to make the victim feel like it is legitimate.
The scam comes in when victims are wanting their chance for that amazing prize. The scammers collect the victim’s full name, email, mailing address, phone number, and complete bank card data.
The simple truth of “when something sounds too good to be true, it usually is” just doesn’t seem to resonate with Internet users – and that includes employees of your organization. It’s one of the reasons continual Security Awareness Training is so important; by ensuring users are trained at regular intervals (rather than, say, a quarterly breakroom training), users begin to change their mindset towards vigilance when interacting with email and the web, making it difficult for scams like the one above to be effective.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW