New U.K. Phishing Scam uses a £400 Tax Cut as Bait

Pretending to be the U.K. Governments’ Digital Service Team, this latest COVID-related phishing attack seeks to con victims out of their credit card details.

Nearly everyone today has been impacted by COVID-19 – so much so, we’re all tired of hearing about it… that is, until you receive an email offering up a £385.50 Council Tax Reduction.

The email scam begins by informing the recipient “You are getting a Council Tax Reduction considering you’re on a low income or get benefits.” The Council Tax Reduction actually exists, but has strict requirements. In the case of the phishing scam, shown below, the email goes on to offer “The refunded amount will be transferred directly on your Debit/Credit card. Apply now to claim the reductions made over your past two years of Council Tax payments.”

“Applicants” are asked to provide credit card details which will, no doubt, be used to commit fraud.

This email demonstrates how little more than a good scam and reasonable presentation can create enough credibility to fool victims into becoming the unwitting participant.

Employees should be taught via Security Awareness Training to verify email details, such as the from sender’s email address, as well as to scrutinize every detail in an unsolicited email that seems too good to be true.

For example, in the case shown above, the tax reduction amount mentioned in the subject and within the email’s body don’t match – something you wouldn’t expect to see.

Creating a phishing scam is easy. And so is creating a victim. Security Awareness Training is an organization’s best means to elevate defenses, and reduce the risk of email-based scams succeeding.