Rewterz Threat Alert – Phishing Awareness For Employees and Customers of the Banking Industry

SEVERITY: High

CATEGORY: Phishing 

ANALYSIS SUMMARY

Looking at the recent Phishing Campaigns observed attacking employees of the banking sector in Pakistan, it’s highly possible that the same Phishing Attacks are targeting customers of banks too. Therefore, it is suggested to urgently run awareness programs for employees as well as customers.

Phishing emails are fake emails falsely claiming identity of a legitimate organization in order to steal credentials or personal information. Phishing mainly uses popular communication tools like emails, instant messaging and peer-to-peer communication, either directly obtaining sensitive information or luring victims into visiting fake websites.

The fake websites usually look very similar to the legitimate websites of the respective banks and can not be detected as malicious by an unsuspecting user. The information entered on such sites like username, passwords, etc. can be used to carry out fraudulent activities like unauthenticated transactions or can be sold to fraudulent groups for further malicious activity.

IMPACT

Information Disclosure

Credential Theft

Account Compromise

Fraudulent Transactions

REMEDIATION

• Do not share your account information (user name, password, account number, etc) with anyone. Your Bank already has your information and it will never demand sensitive information via email.
• Disable all kinds of auto-download options for incoming files and documents.
• Your account will never be closed automatically even if you have previously ignored your bank’s emails. Any email warning you about closure of your account is fake.
• Never click a link or pop-up message received in an email to access your account. It’s likely to redirect you to a fake log-in page.
• If you want to access your online account, carefully type the legitimate URL in the browser address bar instead of following links.
• Set up real-time scanning for viruses and automatic updates of virus definitions.
• Before processing transactions, Bank employees should verify all transactions directed via Alerts like SMS or email that appears to have come from the bank.
• Be very careful while entering login information on any web page and never try to log in on a site which you did not open intentionally.
• If you receive any email or text that looks suspicious, immediately report to the concerned bank.