Cybercriminals are taking advantage of last-minute shopping to scam users. Many people are ordering Christmas gifts in the final days before the holidays, and scammers are ramping up their malicious activities. Group-IB says it has seen a 34% increase in new phishing sites impersonating delivery services.
Specifically, in the first 10 days of December, Group-IB identified 587 fake sites that imitate legitimate postal and delivery companies. In the previous 10 days, other pages were also identified.
Since the beginning of November, the CERT-GIB unit has identified 1539 such sites, with Germany (18%), Spain (13%), Poland (14%) and the United Kingdom (4%) being the regions where most of the scams are taking place.
See also: United Kingdom: Warns of increased loan fraud before Christmas
However, all of this is believed to be part of a single global campaign affecting postal brands in 53 countries.
According to Group-IB, victims typically receive a message warning of an “urgent” or “failed” delivery. The recipient is then asked to provide their personal and payment details.
Websites usually use official names and logos. URLs are slightly modified (e.g., changing one letter) to make it less obvious to the victim that they are a scam. By using well-known names, attackers give a sense of legitimacy and credibility.
Fraudsters restrict access to such sites based on geographic location, device, and operating system, and keep the sites active for only a few days. These tactics help to avoid detection by authorities.
See also: How to keep your children safe online at Christmas?
Vladimir Kalugin of Group-IB warned that last-minute shoppers are often less careful when visiting shopping sites and when opening emails and messages.
“Scammers are exploiting this sense of urgency by sending fake delivery notifications. The high volume of packages shipped during the holiday season makes it easy for scammers to hide among legitimate delivery services,” he added.
“We recommend that users verify the sender's details, carefully search for official channels, treat messages as warnings, access official websites (which they type into the browser themselves), and stay informed about new scams.“.
Group-IB urged delivery service owners to monitor and block such campaigns before they have a chance to grow.
Consumers can protect themselves from fake delivery websites by carefully checking the website URL. Legitimate websites usually have SSL (Secure Sockets Layer) certification, which is a security protocol that protects user information.
See also: Online shopping: How to shop online safely?
Additionally, consumers can look for ratings and comments about the delivery website. Fake websites often have negative ratings or no ratings at all.
It is also important to check the information contact website's. Legitimate companies will usually have complete contact information, including phone numbers and physical addresses.
Finally, consumers should be wary of offers that seem too good to be true. Fake delivery websites may use these offers to lure consumers.
Source: www.infosecurity-magazine.com
