The FBI recently identified another phishing scheme that attempts to gain access to financial information by tricking email recipients into downloading malicious programs from fake emails and web sites. The malware, named “Gameover,” can steal usernames and passwords and defeat common user authentication methods used by financial institutions.
In most cases, an unsolicited email is sent to an unsuspecting recipient from an address that appears to be part of the National Automated Clearing House Association (NACHA), the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), or some other financial institution. The email informs the recipient of problems with an ACH transaction or bank account and provides a link to a site that is supposed to resolve the phony issue. After the recipient clicks the link, he is directed to a fake site that downloads the malware, which in turn, infects his computer.
Protect Yourself and Your Business
Be sure you, your employees, and your colleagues are vigilant about determining email authenticity before clicking links or downloading attachments.
According to NACHA, some phony emails claim to be from NACHA employees or departments and often include a counterfeit NACHA logo. NACHA, FDIC, and the Federal Reserve all say they don’t send out unsolicited e-mails to bank account holders. If you want to confirm there’s a problem with your account or one of your recent transactions, contact your financial institution directly.
Other best practices include:
- Never download something unless you are certain of its origin and purpose. Similarly, do not click on email attachments or links embedded in emails if you do not recognize the sender or the content.
- Dedicate one computer to handle financial transactions only, and use business-related computers for business purposes only. Do not use computers used for financial transactions for personal web surfing or personal email, and do not open personal files (via download, external drive, CD, etc.) on these dedicated computers.
- Only enter sensitive data on secure web sites, sites whose web address begins with https://.
- Only enter sensitive data on web forms when you have initiated the contact. No web site or email should randomly ask you for credit card data or other personal information.
- Always keep anti-virus software up-to-date so it can protect against the latest security threats. Enable automatic updating so you don’t forget to update. Perform regular scans of your system.
- Regularly check for browser and operating system updates (or enable automatic updating).
- Don’t accept unsolicited jobs online that require you to receive funds from numerous bank accounts and then wire the money to overseas accounts—you could get caught up in a criminal investigation.
If you think you’ve been victimized by this type of scheme, contact the entity purporting to send the email, and file a complaint with the FBI’s Internet Crime Complaint Center.
