09 Apr Watch out for these top COVID-19 scams
The ability to leverage current events is a dream scenario for modern-day cybercriminals. These criminals use events, such as the COVID-19 pandemic, to fuel their malicious intent.
With the global pandemic comes the desire to stay updated with the most current information. However, it can be difficult for internet users to navigate this information and separate fact from fiction. It’s also difficult to ensure that links and resources are reliable. The reality is that malicious activity comes through just about every communication channel: email, social media, text and phone messages, and of course, misleading and malicious websites.
Here are some common examples of what you need to be on the lookout for:
- Malicious Websites. Throughout the COVID-19 pandemic, cyber threat actors have consistently capitalized on global interest surrounding the latest information on the virus. These threat actors take advantage of internet users by registering website domains related to COVID-19. Fake websites and applications typically claim to share news, testing results or other resources; however, they only want your credentials, bank account information or to infect your devices with malware.
With many organizations and employees continuing to work from home, users may let their guard down and be more susceptible to emails from unverified senders. Never give out your personal information including banking information, social security information or other personally identifiable information (PII) over the phone or email.
- Phishing Emails. Expect phishing emails to be on the rise. Cyber threat actors will utilize COVID-19 phishing emails in an attempt to convince the recipient to either reveal sensitive information (i.e. bank account information) or simply try to convince the recipient to open a malicious link or attachment, allowing them to potentially access your system.
COVID-19 vaccine-themed phishing emails may include subject lines such as:
- vaccine registration
- information about your vaccine coverage
- locations where you can receive the vaccine
- ways you can reserve a vaccine
- vaccine requirements
While some phishing emails might be easy for you to detect, never get complacent when reviewing your emails. Expect to receive well-composed phishing attempts that are impersonating well-known and trusted entities, such as government agencies, healthcare providers or pharmaceutical companies. Never open any link or attachment from a source that you cannot clearly identify as being legitimate.
For instance, email phishing campaigns in the past have targeted state-level agencies impersonating the Centers for Disease Control and Prevention (CDC). These emails have requested recipients to click on links in order to view a secured message pertaining to COVID-19 vaccine information. Links such as these could easily direct the user to a webpage that attempts to collect PII, including name, address, date of birth, driver’s license number, phone number and email address.
Notable indications that an email, text or phone call may be a phishing attempt can include inspiring a sense of urgency to click a link or provide information. It may be overfly formal or written in an overly complicated manner and sometimes these phishing attempts request sensitive information or that you review a link or attachment. Phishing attempts can asks users to follow a non-standard process or a process you may find odd.
- Fraudulent Charities. For as long as the pandemic is around there will always be consistent attempts by threat actors to create fraudulent charities seeking donations for illegitimate or non-existent organizations. Fake charity and donation websites will try to take advantage of one’s good will, especially during such hard times. Always do your research before donating and providing any information.
- Unemployment Scams. As tax season is quickly approaching, be wary of identity theft scams involving fraudulent claims, especially surrounding unemployment benefits. This scam has especially skyrocketed during the COVID-19 pandemic as unemployment claims in general have been on the rise. The most typical scams to be on the lookout for, but are not limited to, include telling recipients that they’ve won contests, a cash prize or are eligible for an award for applying for unemployment.
Phishing remains a prominent attach vector for almost all cyber threat actors. Your cybersecurity best practices will always be your first line of defense against phishing. Here are some recommendations you can take to shield yourself form these threats:
- Establish a properly configured firewall.
- Ensure your internet-connected devices are not connected to any public internet.
- Report any suspicious emails to your organization’s IT department.
- Enable strong authentication tools, such as Multi-factor Authentication (MFA).
- Learn how to activate MFA on your accounts, head to Stop. Think. Connect.
- Continuously update your passwords and update any default unsecure settings. Ensure backup protocols are in place with your devices.
- Never give out personal information including banking information, social security information or PII over the phone or email.
- Always verify a charity’s authenticity before making a donation. For assistance with verification, utilize the Federal Trade Commission’s page on charity scams.
If you suspect you’ve been impacted by a scam or attempted fraud involving COVID-19, you can file a report with the Cybercrime Support Network.
LEARN MORE: