INKY has published a report on the use of small business grants as phishing lures. Scammers are impersonating the US Small Business Administration (SBA) to distribute phony grant applications hosted on Google Forms.
“Unbeknownst to many, the SBA recently stopped accepting applications to their COVID-19 relief loan and grant programs,” INKY says. “Still, [the phishing email] includes an enticing offer for any unknowing small business owner: Simply fill out the form and find out if you’re qualified to receive the funds. Clicking on ‘Apply Now’ takes recipients to a survey on Google Forms.... Any small business owner who had previously applied for legitimate loans and grants could be easily fooled by the form itself. The top of the form appears to be a cut-and-paste of a genuine COVID-19 grant message and the questions which follow are very similar to those the SBA asks applicants in legitimate circumstances.”
The Google Form asks the user to submit their personal and financial information, including their social security number, driver's license details, and bank account information.
The researchers note that there are several red flags that could have alerted observant users, including typos and grammatical errors in the phishing email.
“There is something else that a more discerning eye might have noticed,” the researchers write. “Because this cybercriminal used a legitimate Google Forms survey to harvest credentials there is a line populated just under the ‘Submit’ button that says, ‘Never submit passwords through Google Forms.’ It’s not a good lesson to learn the hard way. Ironically, if you look a little further, beneath the ‘Submit’ button you’ll also see Google’s ‘Report Abuse’ button. It’s not an option you see too often in phishing scams, and could easily be ignored by anxious small business owners who fall for this threat.”
New-school security awareness training can teach your employees to follow security best practices so they can avoid falling for social engineering attacks.
INKY has the story.
Here's how it works:
