We’re seeing a flood of “phishing” email – this is spam that is designed to trick you into revealing your login information for email, bank, PayPal, Costco or other important site. The quantity of this mail is up by several orders of magnitude, and while our spam filters block or quarantine 99+% of these, that last fraction of a percent is still a big number.
How this spreads: when somebody falls for this and reveals their email login password, their account is then taken over to send as many phishing messages to other people as possible before the provider detects that this is happening and locks the account until the password can be changed. Since these messages come from normally-innocent addresses, odds of them being recognized as spam are reduced, so any successful hijack can lead to several others.
Here are examples of some phishing messages that have targeted our customers. These are designed to look scary and create a sense of urgency. Often the messages contain typos that give them away, but just as often they look pretty real, even using our logos. If you hover your mouse over the link you’ll see that it goes somewhere else (often in another country), but if you’re on your phone, this isn’t easy to see.
Other phishing mail that you might see are impersonations of brands or companies you’re likely doing business with, like Costco, where they’ll tell you that Costco will pay you $100 if you fill out a survey. Their goal is to get your Costco login, and whether or not they then buy things on your credit card from Costco, they’ll use any credit card information you have set up there. Sometimes they’ll claim that you’ve just been charged $800 for something you don’t recognize. We’ve seen these come through pretending to be from Geek Squad, PayPal, McAfee, Chase, Microsoft, Amazon, Apple, Norton, Microsoft and many others.
There’s more information on phishing mail here: 6 types of phishing … How to spot phishing … Ace Hardware phishing.
If something looks too good to be true, is trying to create a sense of urgency, or in any other way looks suspicious, don’t click on the links. Most of these phishing messages are blocked and you won’t see them, but some are put in your quarantine because our spam filters think the message is probably, but not definitely, bogus. If you see a message in your spam quarantine that looks like one of these, don’t fall for it – it’s in your quarantine because it looked suspicious.