Customer Care Numbers as Phishbait
Researchers at CloudSEK have published a report looking at fraudulent customer service phone numbers in India. The researchers found around 20,000 of these phone numbers targeting users in India. The scammers purchase SIM cards from dark web markets, then trick people into handing over their financial information.
“The working of these scams has been more or less the same over the years where the scam begins with the purchase of burner (untraceable) sim cards. These sim cards are issued under fake identities and allow the threat actor to operate without worry. Threat actors are increasingly using this modus operandi to remain undetected. As a next step, they use social media posts, websites with search engine optimization techniques, and advertisements to get a wider reach and be accessible on search engines.”
The scammers use typical social engineering tactics, such as inducing fear and a sense of urgency.
“The unwary users search for them and may end up calling a fake customer care number,” the researchers write. “When customers call these fake call centers, they use this opportunity to retrieve financial information, OTP, etc., from aggrieved customers via social engineering methods. Generally, scammers try to leverage impersonation and the fear factor to collect money from the victims. Thereafter, the threat actors gain access to the victim’s bank account and purchase gift cards, etc, or transfer the amount to another account.”
The majority of the fake phone numbers were registered in the most populous regions of the country.
“An analysis of the area-wise breakdown of fake numbers revealed West Bengal as the most prominent hub, accounting for ~23% of the total registered fake customer care numbers,” the researchers write. “Kolkata served as the center for many large-scale operations. Delhi and Uttar Pradesh tied up for the second place, accounting for ~19% of the total registered fake numbers (9.3% recorded in each state). A possible reason for this can be the presence of various fake SIM card rackets in West Bengal, Delhi, and Uttar Pradesh. Law enforcement in these regions has time and again busted several groups with SIM cards purchased using stolen or forged identification documents.”
New-school security awareness training can enable your employees to thwart social engineering attacks.
CloudSEK has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW