The scammers never stop trying to fool people and this particular version of a phishing scam is NOT new. This is the third time this year that this version of a typical phishing scam has arrived in university mail accounts. Last time it fooled several people, personnel and students alike, so there IS a danger.

I have attached a screenshot of the scam and highlighted the tricks that the criminals use to fool us. See if you can spot them yourselves…

1. Sent from a compromised account, not in South Africa (In this case a university in the USA)
2. It is not addressed to you… Just a “Dear Webmail user”
3. The amounts displayed that Webmail account have are incorrect. Stellenbosch Students have 1Tb of storage on their Office365 accounts. Personnel currently has 500Mb by default.
4. Large letters telling you the “CLICK HERE” to “”update” your account. The link does not go to a Stellenbosch site, but a server under the control of the scammers elsewhere.
5. Threatening language to bully you into complying with their scam.

So how do you tell the difference between a phishing message and a legitimate message? Unfortunately, there is no one single technique that works in every situation, but there are 10 things that you can look for:

1. The message contains a mismatched URL – If the hyperlinked address is different from the address that is displayed, the message is probably fraudulent or malicious.
2. URLs contain a misleading domain name – The last part of a domain name is the most telling. If the links do NOT end with SUN.AC.ZA, then it is a phishing scam.
3. The message contains poor spelling and grammar – with the growth of SMS, WhatsApp and social media, poor spelling and grammar have become the norm, but bad grammar will never come from Information Technology.
4. The message asks for personal information – No matter how official an email message might look, it is always a bad sign if the message asks for personal information. Your bank doesn’t need you to send them your account number. They already know what that is.
5. The offer seems too good to be true – There is an old saying that if something seems too good to be true, it probably is. If you receive a message from someone unknown to you who is making big promises, the message is probably a scam.
6. You didn’t initiate the action – If you get a message informing you that you have won a contest you did not enter, you can be sure that the message is a scam.
7. You’re asked to send money to cover expenses – One telltale sign of a phishing email is that you will eventually be asked for money. If that happens, you can be sure that it’s a scam.
8. The message makes unrealistic threats – If a message makes unrealistic threats, it’s probably a scam.
9. The message appears to be from a government agency – Phishing artists who want to use intimidation don’t always pose as a bank. Sometimes they’ll send messages claiming to have come from a law enforcement agency, SARS, or the SA Police , or just about any other entity that might scare the average law-abiding citizen.
10. Something just doesn’t look right – casino security teams are taught to look for anything that JDLR—Just Doesn’t Look Right. This same principle almost always applies to email messages.

[ARTICLE BY DAVID WILES]

This entry was posted on Thursday, August 11th, 2016 at 9:03 am and is filed under E-mail, Security. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.