As the pandemic now focuses on proving vaccination status in many locales, scammers are taking the opportunity to leverage the need for documentation to steal personal information.
First came the PPE scams. Then scams focused on getting the vaccine. Now cybercriminals are continuing the pandemic theming and responding to the current state of the pandemic by using the requirement to prove vaccination status to create a sense of urgency to get potential victims to act.
According to new findings by security researchers are security vendor Tessian, 22% of U.K. residents have received an email claiming to be the National Health Service (NHS) informing the recipient they must click a link to request and download their COVID-19 vaccination passport or certificate.
Source: Tessian
The scam really comes into play when they are asked to prove who they are by providing personal details, banking information, and even a credit card. Using a realistic-looking website, scammers are able to take victims for any and all information provided, which can be used to further other scams or commit fraud.
Source: Tessian
According to Tessian, 35% of U.S. residents have received a similarly-themed email in 2021. The details provided by would-be victims gives cybercriminals the information they need to further attacks that may target the victim personally or in a professional setting. It’s no stretch of the imagination to think the end goal is to send victims additional phishing emails using collected details for added credibility to infect endpoints as launch points for ransomware, BEC, and data theft attacks. Your users should be protected by enrolling them in continual Security Awareness Training so they can elevate their sense of vigilance and see these scams for what they truly are – before the damage is done.
