FTC Warns of MetaMask and PayPal Phishing Campaigns

The US Federal Trade Commission has issued an alert warning of phishing campaigns that are impersonating PayPal and the MetaMask cryptowallet.

“If you got an email that seems to be from MetaMask or PayPal, stop,” the FTC says. “They’re phishing scams. The MetaMask fake says your cryptocurrency wallet is blocked. And, if you don’t act fast, click a link, and update your wallet, they say your crypto will be lost. The phony PayPal message says BNC Billing cancelled your payment to Binance — and it gives you a phone number to reach PayPal…except that’s a scam, too. If you get one of the messages, delete it.”

The FTC explains that many phishing attacks attempt to convey a sense of urgency to make users act without thinking:

“Most unexpected emails saying to act quickly, click a link, or call a number are phishing scams,” the alert says. “They may look like they come from companies you know, but they’re from scammers who want you to think the message is real. That way, scammers think you’ll click into a fake website or call an actual scammer — all to solve a fake problem. If you click or call, the scammers will steal your financial or personal information, and that could lead to identity theft.”

The FTC offers the following advice for users:

• “Slow down. Ask yourself: Do I have an account with the company? Do I know whoever sent the email? If ‘no,’ it’s a phishing attempt. If ‘yes,’ still check it out. Contact the company using a number or website you know is real. And, if you own a cryptocurrency wallet and have a concern, contact the cryptocurrency exchange that holds your wallet.
• “Don’t click on any links. Links in unexpected texts or emails could lead to identity theft or let scammers install malware.
• “Update your security software. This will protect your phone and computer from security threats, which could expose your personal or financial information to scammers.”

New-school security awareness training can enable your employees to follow security best practices so they can avoid falling for social engineering attacks.

The FTC has the story.