Smishing Scams Abuse Name of Legitimate Ukrainian Charity
Researchers at Trend Micro have spotted yet another scam taking advantage of the crisis in Ukraine by impersonating a legitimate charity. In this case, the scammers are posing as the relief organization Mercury One, attempting to steal money and personal information. We wrote about a “Help Ukraine” cryptocurrency scam and a Ukranian charity phishing scam last month, this is just the latest variety.
“People have reported receiving text messages claiming to be from Mercury One that mimic — or even copy exactly — legitimate texts from Mercury One,” the researchers write. “The included links in the text messages send readers to a phishing site designed to steal their personal information, including payment details. Such text messages were not sent by Mercury One, but by scammers wrongfully impersonating the charity. The phishing site is operated by scammers too and isn’t affiliated with Mercury One in any way.
The researchers note that you shouldn’t trust any unsolicited messages, especially if they attempt to convince you to give money.
“If you receive a text message that claims to be from Mercury One, you should verify the included URL before entering any information,” the researchers write. “If you want to donate, but you have concerns about the legitimacy of a link you have received, the safest practice is to visit Mercury One’s official website directly and donate there.”
Trend Micro offers the following advice to help people avoid falling for these scams:
- Double-check the sender’s mobile number/email address.
- Be suspicious of free gifts or prizes as these are highly likely to be dangerous.
- Regarding charities, always do your research into the organization. These are good links: Charity Navigator & Charity Watch.
- Keep an eye out for tell-tale signs of scams: grammatical mistakes, grand claims, exclamation marks (!).
- Never click links or attachments from unknown sources.
New-school security awareness training can give your employees a healthy sense of suspicion so they can recognize social engineering attacks.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW