In the past week, we have become aware of increased activity by telephone scammers targeting staff members. The groups behind these scams are highly organised, professional, and ruthless in their operation. Here are our tips on how to spot and avoid these scams.
What to look out for
Cold calls
There are many variations of this scam, but they all follow a similar basic pattern.
- You receive an unsolicited call – for example from someone claiming to be from Microsoft Support stating they have detected an issue with your computer, or someone claiming to represent BT who says they have discovered an issue with your broadband service.
- The scammer convinces you to install a remote access tool, allowing them to access your device.
- The scammer performs some form of check, then claims to have identified a major problem. They may employ several convincing tactics here – for example, pointing out harmless issues flagged in your computer’s registry, or installing fake scanning software designed to display alarming error messages.
- Finally, they claim they can fix the problem if you pay a fee using your debit or credit card.
Other variations of this scam include convincing you to login to your online bank to make payments, or to fill out a fake payment authorisation form specifically designed to steal additional personal information. Scammers can then sell on this information, or use it in further fraud attempts.
Malicious pop-up ads
A more effective method scammers employ is malicious online advertising, or Scareware. These are typically hosted on a web domain similar to a popular website (e.g. https://microsft.com instead of https://microsoft.com/). When triggered, the ad displays an error message stating that a critical issue has been detected on your computer and provides a fake support number for you to contact. The ads are often accompanied by audible klaxon or alarm sound effects.
The fact that it is you – the victim – who phones the scammer, rather than vice versa, is a powerful social engineering technique. It makes the process seem genuine, and is often referenced by the scammer as proof of legitimacy if you become suspicious.
Similar scams may claim that files will be encrypted/wiped unless you buy a recovery tool, or that illegal activity has been detected and you must pay a fine. These ads can be persistent and not easily closed. A reboot usually does the trick in such cases.
How to deal with scammers
Always remain suspicious of any form of unexpected contact or pop up advertising. If you are being urged to act quickly to make a payment, or to install software, you may be the victim of Social Engineering.
Be especially wary of unsolicited calls. If you are at all unsure, don’t give out any information over the phone. End the call and either verify by calling back using the number provided on the relevant organisation’s official website, or seek advice. Never provide payment details or allow anyone to connect to your computer; seek guidance or call back via an official phone number to verify.
Never click on browser pops ups or links claiming to offer IT support or fix a problem with your computer or internet connection.
Still unsure?
If you are still unsure, or if you would like advice, contact the Service Desk by email at servicedesk@abdn.ac.uk or via the service portal at https://myit.abdn.ac.uk.
Further information
- For more insight, we recommend this BBC report detailing how an ethical hacker managed to infiltrate a sophisticated telephone scam operation – Criminals on CCTV: Scammers caught red-handed.
- You can find out more about Cyber Security in our Toolkit resource at www.abdn.ac.uk/toolkit/skills/it-security/
Author: IT Security Team, DDIS