New U.K. Phishing Scam uses a £400 Tax Cut as Bait

phishing attackPretending to be the U.K. Governments’ Digital Service Team, this latest COVID-related phishing attack seeks to con victims out of their credit card details.

Nearly everyone today has been impacted by COVID-19 – so much so, we’re all tired of hearing about it… that is, until you receive an email offering up a £385.50 Council Tax Reduction.

The email scam begins by informing the recipient “You are getting a Council Tax Reduction considering you’re on a low income or get benefits.” The Council Tax Reduction actually exists, but has strict requirements. In the case of the phishing scam, shown below, the email goes on to offer “The refunded amount will be transferred directly on your Debit/Credit card. Apply now to claim the reductions made over your past two years of Council Tax payments.”


“Applicants” are asked to provide credit card details which will, no doubt, be used to commit fraud.

This email demonstrates how little more than a good scam and reasonable presentation can create enough credibility to fool victims into becoming the unwitting participant.

Employees should be taught via Security Awareness Training to verify email details, such as the from sender’s email address, as well as to scrutinize every detail in an unsolicited email that seems too good to be true.

For example, in the case shown above, the tax reduction amount mentioned in the subject and within the email’s body don’t match – something you wouldn’t expect to see.

Creating a phishing scam is easy. And so is creating a victim. Security Awareness Training is an organization’s best means to elevate defenses, and reduce the risk of email-based scams succeeding.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews