Phishing, smishing and vishing

Phishing is a scam
that takes place by email. A typical phishing attack happens when a legitimate-looking email, which appears to be from a bank or other financial institution, is sent to an individual requesting you to update or verify your personal or account information.

Fraudsters often try to scare you into opening a phishing email for example by saying “Your account has been accessed” or “Your account will be blocked,” or they entice you to click on links by saying “There was a large deposit made into your account”. When you click on the link in the email, it directs you to a legitimate-looking website. After you enter your personal details, account details, PIN and password on the fake website, the information is forwarded to the fraudsters, who are then able to access your bank account allowing them to transfer funds from your account into fraudulent bank accounts within minutes. This phishing scam happens when cybercriminals collect usernames and passwords for email accounts. Once they have the information, they hijack email accounts and if the accounts are used for banking or business purposes, they impersonate the account holders and order goods or services, request that banks make transactions on their behalf or notify business clients of a change of banking details.

Smishing is much like phishing, except that it involves text messages sent to cellphones. In a smishing message you could be asked to click on a link in the text whereafter you will be redirected to a legitimate-looking website asking you to supply your personal and/or account information, just as you would in a phishing scam. You could also be asked to call a toll-free number where a fake automated voice-response system will ask you to provide personal information, such as passwords and PINs.

Vishing entails social engineering over the telephone. Fraudsters call you and lure you into giving personal information to an automated voice-response system. Fraudsters also use a technique called 'caller identity spoofing', where calls appear to be made from a legitimate or known number, allowing fraudsters to get your personal details.

How do cybercriminals get access to your email account?

You receive an email that purports to be from Hotmail, Google or Yahoo stating one of the following:

• Your email inbox is full. Please click on the link provided to delete messages or increase your mailbox size.
• Important and for immediate attention: Please log in using the link provided.
• We are experiencing congestion due to anonymous accounts. We will be closing some email accounts. Please confirm if you would like to retain the email account by logging on through the link provided.
  

Other tactics include posing as a company asking you to log on through the
provided links to access your online information.

You could also unknowingly download malware on your computer when you open an unsolicited email or click on a link in an email. You will be taken to a fake website that looks the same as your service provider's site or you may be asked to complete a fake form. Once you enter your login details, cybercriminals steal
your details and use them to hijack your email account.

Apart from being able to send mails using your email address, cybercriminals
also create a rule in your mailbox to move any mails from a specific sender to
folders on their own computers. You will be totally unaware that your email
credentials and confidentiality have been compromised.

What can the cybercriminals do once they have access to your email account?  

• If the email account is used for banking or business purposes, cybercriminals could impersonate you as the accountholder and order goods or services, request that banks make transactions on their behalf or notify business clients of a change of banking details. The bank and other businesses may accept these emails as if they came from you without
  knowing that an unauthorised third party gained access to your email account.
• Some email accounts have your credit card details on record for future purchases. By accessing your account, fraudsters could access your credit card information.
• Cybercriminals can trawl through your mailbox and use sensitive documents (such as copies of identity documents, passports, mails from suppliers and family) to make their scam seem legitimate and convince you that they are in fact the person they are claiming to be.

Signs that your email account has been compromised  

• You get complaints about spam messages being sent from your email address to contacts in your address book or to strangers.
• You do not receive any emails or some emails appear to be missing.
• You receive large numbers of undeliverable or bounce messages for emails you did not send.
• You cannot log into your email account.
• Unknown emails appear in the sent-items folder.

Telephonic technical-support scams
These scams happen when someone posing as a representative of an IT company (e.g. Microsoft) contacts you and offers to help you with solving a computer problem, or offers to remove viruses or tries to sell you a software licence.

These 'representatives' then ask you to go to a website or to click on a link that will allow them to access your computer remotely so that they can do the repairs, remove viruses or download the software you bought. Once they have accessed your computer, they can do any or all of the following 

• Trick you into installing malicious software that captures sensitive data, such as online banking user names and passwords. Afterwards you may be charged to remove this software.
• Take control of your computer remotely and adjust your security settings to leave your computer vulnerable.
• Request credit card information so they can bill you for repairs or software ordered.
• Direct you to fraudulent websites and ask you to enter credit card and other personal or financial information.

Tips to protect you from phishing, smishing and vishing  

• Remain in control of your computer. Never allow remote control of your computer or enter your credit card details on a website unless you are absolutely sure that it is legitimate.
• Maintain a healthy scepticism. Be suspicious of any emails or SMSs that ask for your personal information or banking details. If you want to access a site, type the full name of the site into your browser bar and navigate from there. Never click on a 'quick link' in an email.
• Make sure your computer is secure. Keep your antivirus and operating-system software up to date.
• Do damage control when necessary. If you have compromised your personal information in a phishing or smishing scam, it is imperative that you immediately change your PIN and password. Keep in mind that you should also immediately report the incident to the Nedbank Greenline on 800 55 777 or 800 22 072
• Look at your URL bar. Secure sites always start with 'https' (not 'http') and have a little gold lock next to it. If you see the little gold lock next to an 'http' you know it is a fraudulent site.
• Hover over hyperlinks. Hover your mouse over any hyperlinks to reveal the actual URL and check that it is, in fact, the address stated in the email.If you receive a phishing email, do not respond to it. Simply delete it from your inbox and trash folder.