A new phishing scam is leveraging trusted aspects of ecommerce to make their scams look legitimate.
Perception Point has spotted a new level of credibility used by phishing scammers in which fake payment pages include the use of legitimate support chat.
Spoofed payment pages resembling marketplace, like Etsy and Upwork, ask business owners to “claim” payments for products or services sold. On the simple side of the scam, victims are taken to a spoofed Stripe page and are asked to provide their credit card details Once provided, the scam is complete.
On the more complex side of the scam, on the initial spoofed marketplace pages are legitimate chat icons in the lower right:
Source: Perception Point
When clicked, a support chat starts. And, according to Perception Point, it appears as if it’s being staffed by a real person. The chat scammer is intent on getting victims to follow the steps to the fake Stripe page and complete the scam.
But it’s the use of the chat that both got the attention of Perception Point and me; this is an extraordinary step for attacks that are designed to be fully automated and scalable – as a human-staffed chat is neither of those things. It demonstrates the commitment these scammers have to their scam – something most employees that haven’t yet undergone security awareness training are prepared to fend off.
This scam represents an expansion of the lengths attackers will go to be successful. Your employees need to as vigilant as these attackers are committed.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
