General News

Watch Out: 419 E-Mails Imitating Your Bank


Bank account fraud is on the rise, and the tactics for creating deceptive e-mail messages and websites are getting more sophisticated. That’s why you need to watch out for suspicious 419 E-mails that cunningly ask for your banking information.
 

JPMorgan Chase Data Invasion, and other data breaches lately are a great opportunity for the online criminals to deceive customers of other banks that financial institutions around the world are upgrading their security system.
Then they trick you to hand over your banking details for security check.
And because of the words “security check”and the thought that the e-mail came from your real bank, you’re likely to respond to such fraud claims, but it is part of cyberciminals’ tricks to gain access to your banking information.
Target of 419 Sneaky E-mails

Most of the time, you indirectly hand over your own banking info to cyber criminals without realizing it. You’re a target because online fraudsters know that financial information of banks is hard to get into, their next stop is you.
These are what 419 aims to get from you through their phishing e-mails:

  • Name and username 
  • Password or PIN 
  • Address 
  • Phone number 
  • Bank account number 
  • ATM/debit or credit card number 
  • Card verification value (CVV) 
  • Social security number (SSN).

Then they use the collected details to defraud you.
How to Identify 419 E-mails

Unfortunately, fraudulent email is dynamic which makes it very difficult for an average person to easily identify. However, here are some of the things you can lookout for:
1. Urgency

Fraudulent email from 419 may be polite and accommodating in tone PLUS the sense of urgency so that you click without having second thought. Even if the fake e-mail message is personalized, the urgency should make it questionable. 
Here is an example from a real phishing scheme:

“Dear valued bank member, it has come to our attention that your account information needs to be updated due to inactive member, frauds, and spoof reports. Failure to update your records will result in account deletion. Please follow the link below to confirm you data.”

2. Requests for your banking information via an e-mail message

Banks have a policy that they do not ask for your banking information through e-mail. Probe an email that asks for your ATM/debit or credit card number, or any other financial details through an e-mail communication.
3. Fake links

Cybercriminals have the technological prowess to create misleading links that can redirect you to fake website.
4. If Message body is an image   

419ners often use image in the message instead of text. They use this so as to avoid detection by spam filters. If they use real text, it may be junked by the e-mail filter. The message body is usually a hyperlink.
On PC: You can identify this when you rest the pointer on the message body, the pointer becomes a hand.

On Mobile phone: Using pointer may not be possible for users of mobile phone, so the best thing is to delete such message right away, if you don’t have reliable anti-virus app that can block such malicious message.
Because when you open the e-mail message the images are downloaded and your information is passed back to the originating server. This information is used to verify that your e-mail address is valid and so you might be spammed again.
Some browsers-both on mobile phone, and PC-by default automatically block these kinds of external images, but it’s best when you’re cautious too.
5. Attachments

Most of the phishing schemes ask you to open attachments. The attachments are meant to infect your computer with a virus or spyware which can then record the keystrokes you use to log into your online banking accounts and then send that details back to the online criminal.
6. Too good promises

Don’t be anxious about email offering money or discount. It may mimic the tone of your real bank. Contact your bank in case you receive “promo e-mail” claiming to be from your bank for clarification about an offer that sounds too good.
How to Treat Dubious E-Mails

  1. Disregard such fraudulent email or message by not clicking on any of the links. 
  2. Promptly delete the e-mail, the more it stays on your device, the possibility of it getting a click through. 
  3. It’s not advisable to generate a token for anyone via email, phone, and chat. 
  4. Call your bank if you received such e-mail to verify its authenticity
  5.  If you’re not using the official mobile bank apps of your bank, always access your bank online through its real website. 
  6. Protect your account data jealously by being careful with your email communications.One of the tricky tactics used by fraudsters is to intercept email communications and substitute the information. So make sure to check all emails received to ensure sender’s email address is accurate.
  7. Up till now, I’ve not seen bank that will ask for your confidential information via emails, so never reply any email that says you should confirm your security details.Always send email communication via email accounts that use HTTPS protocols to provide an added level of security. 
  8. Banks rarely use shortened URL in email communications, when in doubt of any short URL, delete it, or use tools that reveal the URL extension so that you’ll know where you’re be taken.

You can use expand link facility (that supports almost all over 300 URL shortening services like bit.ly, t.co, goo.gl and many other) to check short URL. Check any short URL by using CheckShortURL
Best Practices for M-Banking against Fraud

The popularity of mobile bankinghas placed your banking details at a great risk. Do you know that you’re more susceptible to fraudulent e-mails if you use Yahoo Mail App, Gmail App, and other e-mails apps? There are two reasons for this:

  1. E-mail apps let you receive electronic mails on the go wherever you’re, and with the possibility of getting a click through; 
  2. And because mobile devices are not designed in such a way that you can place your cursor on a link to reveal the identity of URL.

 One of my articles discusses top 20 mobile banking security tips, but here are other security precautions you can take while getting e-mail messages on the go:
1. Never reply to e-mail messages that request your personal information

Watch out for any e-mail message from a business or person that asks for your account information. It is also one of the tricks of 419 to send you personal information they’ve gotten through other means and asks you to update or confirm it, never update any info sent to you through e-mail.
2. Never call number listed in a suspicious e-mail

If you are unsure of the veracity of an e-mail, call your real bank to verify, and do not call a phone number listed on the e-mail message. Additionally, never volunteer any of your personal details to someone who places an unsolicited call to you.
3. Suspicious e-mail links are dangerous

It’s better not to click a link contained in a suspicious e-mail or text message. The link might be fraudulent. It’s better to visit Web sites by typing the URL of your real bank-the message claims to represent-into your browser.
4. Don’t send your banking details in regular e-mail messages

Regular e-mail messages are not encrypted which could be intercepted. If you must use e-mail messages for personal transactions, use web access that supports S/MIME security.
5. Avoid copy and paste links from messages into your browser

One of the techniques that criminals have used in the past is to fake links. In HTML-formatted messages, the link you are persuaded to click might contain your bank’s address or real name and can be “masked,” which means the link you see does not take you to that address but somewhere different, usually designed by 419 and other and other online crooks.
For instance:
https://www.moridyonebank.com/loginscript/user2.jsp

may take you to
http://192.165.234.60e/morid/index.htm

This is designed to getting your details. When you see the first one, you instantly think that it is from your real bank.
So copy and paste links from messages into your browser is dangerous, the link may be impersonating your bank’s URL.
6. Avoid URL that contains @

Any URL that contain the @ sign would take you to the location that succeeds the @ sign, because browsers ignore everything in the URL that precedes the @ sign.
For instance:
https://www.moridyonebank.com@sy.hg/customer_verification.aspx

You would be taken to: sy.hg/customer_verification.aspx, which could be an unsafe site.
7. Know the correct spelling of your bank’s URL

Another common technique that has been and still been used by 419 is a URL that at first glance looks similar to your bank’s URL. But on closer scrutiny you discover that the address, spelling has been slightly altered.
For example, www.moridyonebank.com could appear instead as:
www.moridonebank.com
The bottom line is: Knowing your bank’s URL helps so that you don’t enter your personal information on spoof site which URL looks like but not your real bank.
8. Help protect your mobile device

Keep your mobile phone and your mobile banking apps updated, and use antivirus software.
9. Use strong passwords and change them often

There is lots of combination of uppercase and lowercase letters, symbols, and numbers you can use as password (which will be simple for you to remember) which make it difficult for other people to guess. Don’t use your real name, surname as passwords. Vary your password for each of your accounts and change them frequently. 
10. Monitor your transactions

Review your bank statements often to make sure that you’re being charged only for transactions you made. Report any irregularities in your accounts to your bank without delay. Don’t use third party, communicate with your bank directly.
11. Auto-rememberof your password on your device is a security threat to your personal information should your device gets lost.
5 Simple Steps Report Email Fraud

To report a suspected email fraud, text message impersonating your real bank, and other dubious communications aim to get your account details, follow these steps:
  1. Visit the official website of your bank, avoid the link sent to you via the email, or text message. 
  2. Give details of the fraud incident. 
  3. Don’t open, or click on any attachment via the message sent you, clicking or opening attachment in a phishing email could place your device at a great risk. 
  4. Attach the email in the message you want to forward to the enquiries desk of your bank. 
  5. Or click on “forward” to send to the appropriate authority.

Topics