A fantastic example of a Phishing email that has got through our various layers of filtering at the business.
After a millisecond of excitement thinking that I have had something back from the government, realisation kicks in (who gets money back from the Government ?) and red flags start to appear.
Firstly look at the Subject line. They are making it great to look at and inviting you in by using words such as Automatic Payment, Payment Return. Secondly look at the date format, a few months and dates you could get away with a US formatted date, but not today.
Secondly, the from address. Its always worth a glance at the header information here, you can see the real email address being from telenet.be – not a gov.uk site. This should raise suspicions that its not a valid government email address.
Thirdly, I never pay on the credit card, and not entirely sure HMRC would allow it, any money owing.
Above we hover over the link to the alleged payment return Gateway Service (these guys know about the term Gateway with the UK Government), shows us going to some weird domain, another red flag…..
We advise customers to never click on any link in an email unless you are 100% sure its legitimate. If in any doubt, completely separately log into the website by manually typing out the domain name. For example, if you get an email from NatWest saying click here to log in, but you arent sure, just open a web browser and independently sign in
We went a step further, in the interest of education, to have a look at what this site was looking for. We did this in a sandbox environment, meaning if anything happened, Ransomware, Virus or alike, its all contained in a self contained environment.
First issue we notice, is that its not, again, a gov.uk address. This should ring alarm bells.
The actual phishing site looks good. All helpful, educating the phishee (if thats a word) about what they will need to proceed.
Google Chrome doing a great job of telling us its suspicious, lets go one more step 🙂
So at the end of all that, its asking for quite a lot of personal information, and in the next few screens its asking for bank account information, credit card info, including the CVV code.
