Small Business Grants as Phishbait

Small Business Grants PhishbaitINKY has published a report on the use of small business grants as phishing lures. Scammers are impersonating the US Small Business Administration (SBA) to distribute phony grant applications hosted on Google Forms.

“Unbeknownst to many, the SBA recently stopped accepting applications to their COVID-19 relief loan and grant programs,” INKY says. “Still, [the phishing email] includes an enticing offer for any unknowing small business owner: Simply fill out the form and find out if you’re qualified to receive the funds. Clicking on ‘Apply Now’ takes recipients to a survey on Google Forms.... Any small business owner who had previously applied for legitimate loans and grants could be easily fooled by the form itself. The top of the form appears to be a cut-and-paste of a genuine COVID-19 grant message and the questions which follow are very similar to those the SBA asks applicants in legitimate circumstances.”

The Google Form asks the user to submit their personal and financial information, including their social security number, driver's license details, and bank account information.

The researchers note that there are several red flags that could have alerted observant users, including typos and grammatical errors in the phishing email.

“There is something else that a more discerning eye might have noticed,” the researchers write. “Because this cybercriminal used a legitimate Google Forms survey to harvest credentials there is a line populated just under the ‘Submit’ button that says, ‘Never submit passwords through Google Forms.’ It’s not a good lesson to learn the hard way. Ironically, if you look a little further, beneath the ‘Submit’ button you’ll also see Google’s ‘Report Abuse’ button. It’s not an option you see too often in phishing scams, and could easily be ignored by anxious small business owners who fall for this threat.”

New-school security awareness training can teach your employees to follow security best practices so they can avoid falling for social engineering attacks.

INKY has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews