Is your email being “spoofed” by a cyber thief?
You’re checking your email inbox at work when suddenly a “high importance” email comes in that looks like it’s from a Gmail account belonging to your boss.
The message states that the health organization has uncovered illegal activity on its systems and that, as part of an ongoing investigation, the organization and law enforcement need you to share your login credentials via email.
What do you do?
Don’t react immediately
It’s a good bet that this is the work of Cyber Thief Sam, who is impersonating your boss in the hopes of stealing your log in credentials for his own fraudulent gain. This practice is called “spoofing” and is used by a cyber thief to forge an email header to make it appear that the message originated from someone or somewhere other than the actual source.
Instead of providing your log in information, pause and take a second to ask yourself “Does this email look like it’s real? Did my boss really send it? Can it be trusted?”
IMITS Information Security says
- In this scenario, the email is from a Gmail account. In a “spoof” email impersonation attack, the real sender’s domain (i.e. vch.ca) will be different from the impersonated email domain (gmail.com).
- Does the message sound appropriate? It’s possible an investigation is going on, but highly unlikely you wouldn’t have had been told about in in person or over the phone.
- Verify. Verify. Verify. Even after scrutinizing this email, if you’re still unsure about it, call the sender.
More tips coming
Stay tuned for our next article where we see Cyber Thief Sam try to steal personal information by pretending to be from the Canada Revenue Agency.