Understanding and dealing with phishing during the COVID-19 pandemic

Phishing in the years of COVID-19

Many organisations and companies experience changes in their working conditions lately due to the COVID-19 pandemic. This shift has increased remote activities, such as teleworking. Teleworking furthers the reliance on email for communication, thus creating perfect conditions for email fraud schemes.

Cyber criminals are taking advantage of the pandemic by using widespread awareness of the subject to trick users into revealing their personal information or clicking on malicious links or attachments, unwittingly downloading malware to their computers. They may even impersonate government organisations, ministries of health, centres for public health or important figures in a relevant country in order to disguise themselves as reliable sources.

The emails look authentic and may include logos or branding of the specific organisations.

How scammers operate

Malicious email messages that might ask you to open an attachment supposedly containing pertinent information regarding the Coronavirus are likely to download malicious software onto your device as soon as you click on the attachment or embedded link. This software could allow cybercriminals to take control of your computer, log your keystrokes or access your personal information and financial data, which could lead to identity theft.

How to recognize phishing

The emails sent usually:

• look identical to messages from a reputable organisation (such as a medical or governmental institution),
• sound urgent or try to spread fear,
• claim to enclose important information or breaking news,
• ask you to download and/or click on attachments and links.

How to Protect against Phishing Attacks

There are simple steps you can take to avoid the bait:

1)  Take time to reflect on a request for your personal information and whether the request is appropriate. Do not open unsolicited email from people unfamiliar to you or click on suspicious attachments, which you did not expect.

2)  Never supply any personal or financial information and passwords to anyone via email.

3)  Avoid emails that insist you act now. Phishing emails often try to create a sense of urgency or demand immediate action.  

4)  Look for wording and terminology. Apart from phishing, cyber criminals could also trap a specific person via spear phishing using the receiver’s full name. Check for terms and language that is normally expected in the type of email you receive.

5)  Check the email address. Check the sender’s name, email address and whether the email domain matches the organisation that the sender claims to be from. If not, it is probably a phishing attempt.

6)  Check the link before you click. See your emails in plain text to check for the hyperlinked address to see the real hyperlink. If it is not the same as what appears in the email, it is probably a phishing attempt.

7)  Keep an eye out for spelling and grammatical mistakes. If an email includes spelling, punctuation and/or grammar errors, it could be a phishing email.

8)  Be wary of third-party sources spreading information about COVID-19. Refer to the official websites for updates on COVID-19. Fraudulent e-mails can look like they come from a real organisation but legitimate government agencies will never call you or email you directly for this information.

9) Protect your devices. Install anti-spam, anti-spyware and anti-virus software and make sure they are always up to date.

10) Visit websites by typing the domain name yourself. Most businesses use encryption and Secure Socket Layer (SSL) / Transport Layer Security (TLS). If you receive a certificate error while browsing, consider it as a warning sign that something is not right with the website.

What happens if I became a victim of phishing? 

• If you have clicked on a link or opened an attachment that downloaded harmful software, update your computer’s security software and run a scan.
• If you entered login credentials to access information, change them immediately.
• If you have provided your bank details, contact your bank or credit card company.

Take actions

COVID-19 has affected millions of people around the world, while its long-term impact remains to be seen. However, protecting ourselves against coronavirus-related scams is both a feasible and essential step. If you receive a phishing email, you should:

1. Report it to your IT department by forwarding it as an attachment.
2. Delete it.
3. Notify the organization being spoofed in order to prevent other people from being victimized.

Stay updated - subscribe to RSS feeds of both ENISA news items & press releases!

News items:

http://www.enisa.europa.eu/media/news-items/news-wires/RSS

PRs:

http://www.enisa.europa.eu/media/press-releases/press-releases/RSS