Protection on the Internet: Beware of these four phishing traps

It’s better to be safe than sorry – it’s a rule that applies both online and offline. But misfortune often happens faster than expected. That’s what happened to Alex, who wanted to grab a temporary offer on the Internet; to Theo, who sent an e-mail to what he thought was his employer’s HR team last week; or to Nina, who’s upset about an apparently defective app that’s supposed to take her to a photo gallery. The same goes for Laura, who’s sitting at the same table as the others and was so happy about winning an iPhone last weekend. She’s now complaining loudly over her coffee about the long wait and the amount she «still had to pay on top» to get her prize. But what do Alex, Theo, Nina and Laura have in common? They’ve all fallen victim to phishing attacks without the slightest suspicion.

How can that be? Shouldn’t you have been suspicious? Hasn’t there already been enough research on cybercrime? The short and sober answer is no, unfortunately – an assessment that Norberto Ferreira would confirm. As Team Lead Security Operations at Sunrise, he considers one to two cybersecurity awareness days per year to be appropriate and useful for companies.

At Sunrise, Norberto Ferreira is the person who knows the dangers of the Internet the best. He has been working for Sunrise for around 17 years and is committed to the cause. There’s no typical working day for him, since no two days are alike in Security Management, and he and his team are constantly confronted with new challenges.

The core tasks of Norberto Ferreira’s team include the approval of internal company uploads and downloads, customer Internet security, and communication with customers regarding network security. This brings us to the phishing traps that Nina, Alex and the others fell into.

Getting an SMS from someone you think is a family member can also prove to be a high security risk. Many users are not aware of this. As an example, Ferreira refers to the malware Flubot, which was distributed via SMS and caused a lot of red faces in Switzerland, especially last June.

In messages that contained a link to an app, mobile-phone users were informed about «missed voice messages» or «missed package deliveries». However, the app was a tracking app used to steal passwords and sensitive data. What was so insidious about it was that as soon as the malware found its way onto the mobile phone, it was able not only to access contact data, but also send messages to these contacts without being detected. Several thousand mobile-phone users are known to have fallen victim to this trick, and the true figure is likely to be much higher.

With this in mind, it’s clear that the inaccessible photo gallery that Nina wanted to access via an app can cause far more harm than she originally thought. For example, if she downloads the app, like in this scenario, and it turns out to be a phishing attempt, in which fraudsters gain access to her data and then use it to access her bank account.

Fortunately, Sunrise has recognized this risk. This is where the new SMS filter from Sunrise comes into play.

Thanks to the SMS filter, a phishing wave occurring abroad can already be detected and blocked there. The URL will be blocked and the SMS will no longer reach Switzerland. Nina wouldn’t receive a download link to access the harmful app or even see the SMS. Even if an SMS were sent from Switzerland, it would be safe from fraud attempts with this SMS filter from Sunrise.

Cyberattacks are becoming increasingly sophisticated and targeted attacks more frequent. But even cybercriminals who act on the principles of chance and luck don’t always go away empty-handed.

Some phishing e-mails are still sent randomly to thousands of potential victims. Cybercriminals gamble on their victims gullibility or lack of attention. What’s important to note here is that phishers no longer necessarily reveal themselves through typos, misspelled words or e-mail addresses that only appear legitimate at first glance. For this reason, it’s important to be cautious at all times.

If an e-mail like this happens to reach a recipient at the right point in time, they can be quick to share their personal information. That’s also what happened to Theo. When he received an e-mail from the HR team, he didn’t give it much thought at first. After all, he’d just moved, and providing his personal information in an online form that he received via an e-mail link didn’t seem suspicious to him under these circumstances. But, when he didn’t receive his salary at the end of the month, he became suspicious and contacted his employer’s HR team. They, in turn, didn’t know anything about it. He’d evidently fallen into a trap.

Every day, dozens of people fall victim to classified-ad fraud. If an offer on the Internet seems too good to be true, bargain hunters should assume that this is actually the case.

A limited offer increases buyers’ willingness to make risky purchases without even hesitating. The consequences are grim. Instead of a cool headset at a «crazy price», bargain hunter Alex gets a CHF 300.– debit on his account and a mental reminder to be more cautious in the future.

The joy of winning a competition can last a long time, but it might not. There’s no new iPhone on its way to Laura, but rather a request to pay one franc to receive her prize.

According to Norberto Ferreira, there was a surge in this type of fraud two to three years ago. Usually, in such a case, the criminals present themselves as a company that’s running a competition. In some cases, they also imitate social-media profiles, relying on the competition entrants failing to pay proper attention. It’s not unusual for supposed winners to contact the company under whose name the criminals ran the competition, and only then do they realize that it was a scam.

The one franc is then usually gone. But the damage is, of course, much more serious: the credit-card details have been stolen. And if that weren’t bad enough, you often end up automatically signing up for unwanted SMS services when you take part in the competition.

TIP: If you’re a victim of this kind of fraud, contact the financial institution that carried out the transaction for help.

Other tips against phishing: https://community.sunrise.ch/blog/24596-7-tips-against-phishing-attacks

General information on phishing, vishing and smishing: https://www.ncsc.admin.ch/ncsc/en/home/cyberthreats/phishing.html

Current incidents: https://www.ncsc.admin.ch/ncsc/en/home/aktuell/aktuelle-vorfaelle.html