New Phishing Scam Leverages Chat To Add Credibility And Ensure Success



chatbot-phishingA new phishing scam is leveraging trusted aspects of ecommerce to make their scams look legitimate.

Perception Point has spotted a new level of credibility used by phishing scammers in which fake payment pages include the use of legitimate support chat.

Spoofed payment pages resembling marketplace, like Etsy and Upwork, ask business owners to “claim” payments for products or services sold. On the simple side of the scam, victims are taken to a spoofed Stripe page and are asked to provide their credit card details Once provided, the scam is complete.

On the more complex side of the scam, on the initial spoofed marketplace pages are legitimate chat icons in the lower right:

image-5.png

Source: Perception Point

When clicked, a support chat starts. And, according to Perception Point, it appears as if it’s being staffed by a real person. The chat scammer is intent on getting victims to follow the steps to the fake Stripe page and complete the scam.

But it’s the use of the chat that both got the attention of Perception Point and me; this is an extraordinary step for attacks that are designed to be fully automated and scalable – as a human-staffed chat is neither of those things. It demonstrates the commitment these scammers have to their scam – something most employees that haven’t yet undergone security awareness training are prepared to fend off.

This scam represents an expansion of the lengths attackers will go to be successful. Your employees need to as vigilant as these attackers are committed.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews