Gmail phishing scam 2017: how to spot a fake email
Sophisticated hackers are targeting Gmail accounts and sending out phishing emails that are so convincing even IT experts are struggling to spot the fakes. Here's how to stay safe.
A new email scam is so convincing even some IT experts have fallen victim to it.
Criminals are hacking into people’s Gmail accounts, studying emails you’ve already sent and then sending phishing emails to your contacts in a bid to steal their personal information.
Because the hackers have looked at your emails they are able to send out convincing fake emails using your writing style and tone.
As a result it can be very difficult to spot it is a phishing email.
The email will include an image designed to look like a PDF document attachment that, if you click on it, takes you to a phishing page that looks exactly like Gmail’s log-in page.
If you tap in your details the hacker can capture them and then log in to your account too.
Check your free credit report for any suspicious activity
This is the closest I've ever come to falling for a Gmail phishing attack. If it hadn't been for my high-DPI screen making the image fuzzy… pic.twitter.com/MizEWYksBh
— Tom Scott (@tomscott) December 23, 2016
Thwarts security warning
To add to the difficulty in spotting the scam, it doesn’t appear to trigger Google’s HTTPS security warning that notifies users if they land on an unsafe web page.
One victim, an IT worker in a school, explained how the scam lured them in on the Hacker News website.
“The attackers log in to your account immediately once they get the credentials, and they use one of your actual attachments, along with one of your actual subject lines, and send it to people in your contact list.
“For example, they went into one student’s account, pulled an attachment with an athletic practice schedule, generated the screenshot, and then paired that with a subject line that was tangentially related, and emailed it to the other members of the athletic team.”
Once the hackers have your email log-in details they can then access many of your other accounts by using the password reset facility that emails a link to you that they can then intercept.
Plus, they may be able to learn valuable personal information about you by reading your sent and received emails.
Check your free credit report for any suspicious activity
How to protect your email account
Experts recommend that you enable two-step authentication on your Gmail account.
This means, as well as tapping in a password, you also need a code that is sent to your mobile phone in order to log-in to your account.
Also, watch out for the prefix ‘data:text/html’ in the browser bar when logging in, as this is a sign of a fake website, Mark Maunder, CEO of Wordfence, the security service for Wordpress, told the Daily Mail
“Make sure there is nothing before the host name ‘accounts.google.com’ other than the ‘https://’ and the lock symbol,” he says.
“You should also take special note of the green colour and lock symbol that appears on the left.
“If you can’t verify the protocol and verify the host name, stop and consider what you just clicked on to get to that sign-in page.”
Finally, make sure you use different passwords for your various internet accounts.
That way if one account is hacked, the criminals won’t be able to use your log-in details to access other accounts.
The easiest way to keep track of numerous passwords is to make use of a password manager. Learn more about how they work in our complete guide to online password managers.
Check your free credit report for any suspicious activity
Keep informed! More scam warnings on loveMONEY:
Don't fall for these supermarket voucher scams
Comments
Be the first to comment
Do you want to comment on this article? You need to be signed in for this feature