I am always astounded at how easily we are duped into falling for online scams, spoofs, and phishing tricks. Our want to click things that shouldn’t be clicked shows how trusting (or naïve) we all are. I really should put a Don’t Click That! Consider displaying a sign on my computer monitor, possibly as a background.
A good example was this week we were getting my son a passport and realized we didn’t have a long-form birth certificate. Naturally, I went online and used Google to find the “Ontario birth certificate” and clicked on the first entry there. Seemed legitimate. I sent it to Mrs. C8j, who then sent me a note pointing out that this was not a Service Ontario link, but rather a different firm. This firm acted as a middleman, providing a birth certificate, but at a significantly higher cost. Mrs. C8j luckily found the Service Ontario link for Birth Certificates and ordered from there.
This is where we all are too naïve (me especially), assuming the first link that Google brings you must be the right place to click. People pay good money to get to that spot on the search engines, and nefarious folks use black-hat trickery to reach those places.
I had another incident where our curate at Church had sent me an email with a PDF file attached, but I didn’t recognize the email address. He had sent it from his account, and I finally figured out that it was him but called him to confirm. Before I opened the PDF, I also ran an antivirus check on the file. Could I have still been tricked? Yes, quite easily. These are precisely the trickery the bad folks on the web use.
- An email with a hinky document attached (Word, PDF, Excel s/s, and others) from an email account that looks like either:
- A legitimate business that you might work with (A bank or Credit Card is a perfect example of that)
- An account from someone you know. This is usually if you are being targeted directly for an attack (like how they got the Democratic National Committee folks during last year’s election).
- An email with a link to something that has been shortened or looks like a legitimate site. A good example is the phishing email my daughter received from “OSAP”
- A Tweet from a famous person announcing they would be magnanimous and let you make money with them? Don’t Click that, please!
- Any plea for money for the latest world catastrophe, never give money to organizations links you don’t know.
- A subscription update for a product you don’t use. My son keeps getting a re-up email from “McAfee”, but we don’t use their products. I tell him don’t click that.
- If you don’t recognize the link, or it has been shortened never click. There are sites where you can check a link, but I am not sure you should trust them either.
Famous who did Click That!
Billionaires Elon Musk, Jeff Bezos and Bill Gates 'hacked' on Twitter in apparent Bitcoin scam https://t.co/SFXk6kPJO1
— BBC News (World) (@BBCWorld) July 15, 2020
Banks, the CRA, Credit Cards, and most other institutions will not send you an e-mail with a link for things. If you think the e-mail from your bank is legitimate, go to your online banking site (not clicking the supplied link) and see if there is a message.
Most banks and credit cards have an email account where they like to get copies of these sorts of naughty e-mails, so they can keep up with the nefarious nasty folk out there.
Just don’t click that! In the name of all security and protection, DO NOT CLICK THAT!
Cybersecurity Articles
- Phishing and Spearpishing how can I tell?
- A Phishing example, which my daughter received.
- For God’s sake Don’t Click that!
- LastPass Hacked and Best of Technology and Security This Week