Smishing Scams Abuse Name of Legitimate Ukrainian Charity

Researchers at Trend Micro have spotted yet another scam taking advantage of the crisis in Ukraine by impersonating a legitimate charity. In this case, the scammers are posing as the relief organization Mercury One, attempting to steal money and personal information. We wrote about a "Help Ukraine" cryptocurrency scam and a Ukranian charity phishing scam last month, this is just the latest variety.

“People have reported receiving text messages claiming to be from Mercury One that mimic — or even copy exactly — legitimate texts from Mercury One,” the researchers write. “The included links in the text messages send readers to a phishing site designed to steal their personal information, including payment details. Such text messages were not sent by Mercury One, but by scammers wrongfully impersonating the charity. The phishing site is operated by scammers too and isn’t affiliated with Mercury One in any way.

The researchers note that you shouldn’t trust any unsolicited messages, especially if they attempt to convince you to give money.

“If you receive a text message that claims to be from Mercury One, you should verify the included URL before entering any information,” the researchers write. “If you want to donate, but you have concerns about the legitimacy of a link you have received, the safest practice is to visit Mercury One’s official website directly and donate there.”

Trend Micro offers the following advice to help people avoid falling for these scams:

• Double-check the sender’s mobile number/email address.
• Be suspicious of free gifts or prizes as these are highly likely to be dangerous.
• Regarding charities, always do your research into the organization. These are good links: Charity Navigator & Charity Watch.
• Keep an eye out for tell-tale signs of scams: grammatical mistakes, grand claims, exclamation marks (!).
• Never click links or attachments from unknown sources.

New-school security awareness training can give your employees a healthy sense of suspicion so they can recognize social engineering attacks.