Identity theft through phishing - a checklist

According to the Reporting and Analysis Center for Information Security (MELANIE), there have never been as many phishing e-mails or identity thefts as in 2017. However, cyber criminals are using increasingly perfidious methods to harm private consumers and companies. For example, they pose as tax or government officials in order to obtain sensitive data.

A "brazen" e-mail purporting to come from the Federal Tax Administration recently made the rounds. The scammers wrote something about a fictitious tax refund and asked recipients to fill out an attached document. When the file was opened, malware was automatically installed - both on Windows computers and on Macs! Of course, there was no tax refund.

Swiss addresses in our sights

In February, a mail - at first glance from Swisscom - was circulating in which cyber criminals used a similar tactic. The fake bill was marked with the button "View bill", which referred to a prepared website. On this website, the victims were subsequently infected with malware.

According to MELANI, invitations to court hearings or messages from the cantonal police are also used as bait. "The aim of the attackers is to take the user by surprise, arouse his curiosity or scare him, in order to then tempt him into an ill-considered action," the federal agency said.

Checklist against viruses, worms and Trojan horses

E-mail is one of the most popular means of communication. How to protect yourself when it comes to e-mailing and what affected companies should do can be answered by means of this checklist. However, most electronic malware gets onto your computer via e-mail attachments. Careful handling of e-mails contributes significantly to the security of your data and your computer.

The following measures protect you against viruses, worms, Trojan horses, spam and hoaxes:

Beware of e-mails with unknown sender

Do not trust e-mails whose sender's address you do not know. In this case, do not open any attached documents or programs and do not select any links specified in them.

Pay attention to the trustworthiness of the sources

Only open files or programs from trusted sources and only after first checking them with up-to-date antivirus software.

Be careful with file names with two endings

Do not open email attachments that have two extensions (e.g. picture.bmp.vbs). Do not be fooled by the icon of such a file. In Windows Explorer, deactivate the option "Hide extensions for known file types" or "Hide file extensions for known file types".

Software update of the e-mail program

E-mail programs can also have security vulnerabilities. Regularly check whether there is a software update for your e-mail program and install it.

Do not reply to spam

General: Maintain cautious use of email address. Share your email address with as few people as necessary and use it only for important correspondence.

Create a second e-mail address

For filling out web forms, subscribing to newsletters, entries in guest books, etc., it is recommended to use a second e-mail address. This can be requested free of charge from various providers. If this address is affected by spam, it can be deleted and replaced.

Careful, careful, careful ...

If spam is replied to, the sender knows that the email address is valid and will continue to send spam. Spam with an "unsubscribe" option should also be treated with caution. This promises that by sending an e-mail with certain content, you will be removed from the distribution list.

In this context, automatic reply emails in case of vacation absence should also be considered. They should only be activated for known addresses.

Checklist of companies whose names have been misused as senders:

If your company name is misused for fraud e-mails, point out clearly on the home page that your company is misused as a sender for malware e-mails. Give customers your recommendation on how they should behave.

• Alert your customers to the fraud attempts by means of a regular newsletter or directly.
• Adhere to the following basic rules when communicating with customers via e-mail and communicate them to them:
• Use links sparingly in e-mails and link only to your own domain. If possible, use links to pages secured by encryption (https) and inform the recipient of this.
• Do not use hidden links, always make the links visible to the user.
• Do not link to websites that require username and password or other input.
• Address customers by first and last name, if this information is available.
• Sending important account information in writing by letter - especially in the financial sector.

(Source: MELANI, May 2017)

If you have further specific questions about phising, please contact the Reporting and Analysis Center for Information Assurance MELANI directly - Site