Fake Emails Purporting to be from UK Energy Regulator
A phishing campaign is impersonating UK energy regulator Ofgem, according to Action Fraud, the UK’s cybercrime reporting centre.
“Energy prices are set to increase on 1 October 2022 and in the last two weeks, more than 1,500 reports have been made to the National Fraud Intelligence Bureau (NFIB) about scam emails purporting to be about energy rebates from Ofgem, the independent energy regulator for Great Britain,” Action Fraud says. ”In the two weeks from Monday 22nd August to Monday 5th August 2022, a total of 1,567 phishing emails related to this scam were reported via the Suspicious Email Reporting Service (SERS).”
The attackers are exploiting a current event that will affect people in the UK, but Action Fraud says many people recognized the scam because the email set the deadline for the wrong year.
“In this instance, the reported scam emails claim that the recipient is due an energy rebate payment as part of a government scheme and provides links for the recipient to follow to apply for the rebate,” the alert says. “The links in the emails lead to malicious websites designed to steal personal and financial information. All of the reported emails display the email subject header ‘Claim your bill rebate now’ and the criminals behind the scam are using the Ofgem logo and colours to make the email appear authentic. However the emails ask recipients to ‘apply for an energy bill rebate before September 2020’, which prompted many recipients to realise the emails were not genuine and subsequently report the scam.”
Action Fraud offers the following advice to help users avoid falling for these types of scams:
- “If you have any doubts about a message, contact the organisation directly.
- “Don’t use the numbers or address in the message – use the details from their official website. Remember, your bank (or any other official source) will never ask you to supply personal information via email.
- “If you have received an email which you’re not quite sure about, forward it to report@phishing.gov.uk. Send us emails that feel suspicious, even if you’re not certain they’re a scam – we can check.
- “Follow the Take Five to Stop Fraud advice:
- STOP: Taking a moment to stop and think before parting with your money or information could keep you safe.
- CHALLENGE: Could it be fake? It’s ok to reject, refuse or ignore any requests. Only criminals will try to rush or panic you.
- PROTECT: Contact your bank immediately if you think you’ve fallen for a scam and report it to Action Fraud.”
New-school security awareness training can teach your employees to follow security best practices so they can avoid falling for social engineering attacks.
Action Fraud has the story.
Free Phish Alert Button
Do your users know what to do when they receive a phishing email? KnowBe4’s Phish Alert Button gives your users a safe way to forward email threats to the security team for analysis and deletes the email from the user’s inbox to prevent future exposure. All with just one click! Phish Alert benefits:
Here’s how it works:
- Reinforces your organization’s security culture
- Users can report suspicious emails with just one click
- Incident Response gets early phishing alerts from users, creating a network of “sensors”
- Email is deleted from the user’s inbox to prevent future exposure
- Easy deployment via MSI file for Outlook, G Suite deployment for Gmail (Chrome) and manifest install for Microsoft 365
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/free-phish-alert-partner?partnerid=001a000001lWEoJAAW