22% of Brits Received Proof of Vaccination Phishing Email in Past Six Months

Nearly a quarter (22%) of Brits have received phishing emails asking them to download their ‘proof of vaccination’ in the past six months, according to new research by Tessian.

The analysis found that most of these scam messages received in the UK impersonated the National Health Service (NHS), the public body that manages official vaccination pass documentation in the country.

The researchers noted many of these phishing messages look genuine, containing official logos, using accurate display names and correct spelling. The emails commonly looked to convey a sense of urgency to panic victims into acting without thinking clearly. This included using subject lines with terms like “IMPORTANT” and “OFFICIAL,” and describing the potential repercussions of failing to act on the message, such as an inability to travel or requirement to quarantine if instructions are not followed.

Figure 1 was displayed as an example of a message of this type:

Most of these emails then redirected the recipient to a website requesting sensitive data to receive their proof of vaccination. These include personal details and credit card or banking details. These websites were often highly sophisticated, appearing to be genuinely from the NHS,

Tessian also found more than one in three (35%) US citizens received a phishing email requesting proof of vaccination in the past six months.

The findings come during Cybersecurity Awareness Month 2021, in which one of the themes is ‘Fight the Phish.’ This campaign urges online users to slow down and think before clicking on any suspicious emails, links or attachments.

Regarding the proof of vaccination scams, the researchers pointed out that NHS services are free for UK residents, and the institution would never ask for payment details or other financial information. US residents noted that COVID-19 vaccination providers could not charge you for a vaccine or charge you for any administration fees, copays or coinsurance.

Charles Brook, a threat intelligence researcher at Tessian, commented: “Throughout the pandemic, we’ve seen cyber-criminals leverage COVID-related trends as lures in their phishing campaigns. Now they’re capitalizing on the uncertainty surrounding vaccination certificates to dupe people into sharing login credentials and personal or financial information.

“In many cases, the emails purporting to come from the NHS look very convincing. Detecting these scams requires everyone to question messages they receive via phone, text or email. If you are unsure whether a text or email is a scam, then assume it is. Avoid clicking any links or attachments or handing over any information until the sender has been verified. And remember, the NHS won’t charge you for a COVID NHS pass, so any email asking for payment details should be deleted. If you have further questions, go to the official NHS or gov.uk website.”

New-school security awareness training can help your employees thwart targeted phishing attacks.

With thanks to the Cyber Defence Alliance and InfoSecurity Magazine. The full story is here: https://www.infosecurity-magazine.com/news/brits-proof-vaccination-phishing/

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

Here’s how it works:

• Immediately start your test for up to 100 users (no need to talk to anyone)
• Select from 20+ languages and customize the phishing test template based on your environment
• Choose the landing page your users see after they click
• Show users which red flags they missed, or a 404 page
• Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
• See how your organization compares to others in your industry

PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW