CISA Says to Exercise Caution For Disaster-Related Malicious Scams

The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that scammers are exploiting the recent hurricanes that have hit the US. Criminals frequently impersonate charities and related organizations following natural disasters.

“CISA urges users to remain on alert for malicious cyber activity following natural disasters, such as hurricanes, as attackers target disaster victims and concerned citizens by leveraging social engineering tactics, techniques and procedures (TTPs),” CISA says. “Social engineering TTPs include phishing, in which threat actors pose as trustworthy persons/organizations—such as disaster-relief charities—to solicit personal information via email or malicious websites.

CISA recommends exercising caution in handling emails with disaster-related subject lines, attachments or hyperlinks. In addition, be wary of social media pleas and text messages related to severe weather events.”

CISA points to the Federal Trade Commission’s (FTC’s) recommendations for avoiding disaster-related scams. The FTC outlines the following red flags associated with charity scams:

• “Don’t let anyone rush you into making a donation. That’s something scammers do.
• “Some scammers try to trick you into paying them by thanking you for a donation that you never made.
• “Scammers can change caller ID to make a call look like it’s from a local area code.
• “Some scammers use names that sound a lot like the names of real charities. This is one reason it pays to do some research before giving.
• “Scammers make lots of vague and sentimental claims but give no specifics about how your donation will be used.
• “Bogus organizations may claim that your donation is tax-deductible when it is not.
• “Guaranteeing sweepstakes winnings in exchange for a donation is not only a scam, it’s illegal.”

The FTC also says to be wary of job-related scams following a natural disaster.

“You may find yourself out of work after a disaster strikes,” the FTC says. “To trick people looking for honest work, scammers advertise where real employers and job placement firms do. They lie about your chances of getting a job and often ask you to pay before you get one — which is a sure sign of a scam.”

New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for these types of scams.

CISA has the story.

---

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

Here’s how it works:

• Immediately start your test for up to 100 users (no need to talk to anyone)
• Select from 20+ languages and customize the phishing test template based on your environment
• Choose the landing page your users see after they click
• Show users which red flags they missed, or a 404 page
• Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
• See how your organization compares to others in your industry

PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW