Phishing Scam Alert - Fake Emirates Nbd Bank Payment Notification Aims at User's Password

Here are some interesting phishing statistics - the FBI’s Internet Crime Complaint Center reported that in 2019 alone, phishing schemes were used to defraud people $57 million. That number is most likely wildly inadequate at representing the real cost of phishing, as it includes only direct monetary loss incurred by phishing victims who reported the attacks. That’s just a raw sum of money extracted and deposited into the phisher’s scams – it doesn’t include collateral damage incurred by the victims of such attacks. Said damages are usually extensive, even if they don’t lead to a monetary gain for the hacker that organized the attack, leading IT specialists to speculate that the damages done by phishing as an attack and as a vector for further infections each year totals in the billions of dollars, not in the millions. And that’s not even the whole world we’re talking about – just the USA.

The 2019 Verizon Data Breach Investigations Report states that nearly a third of all breaches in the past year involved some type of phishing campaign. Phishing accounts for nearly 80% of all cyber-espionage attacks, according to the same study.

Suffice it to say that hackers have become really adept at this particular type of scam. However, it’s important to remember that ultimately, it’s their victims’ lack of knowledge and awareness that causes said attacks to be so effective.

Case in point – the recent Emirates NBD Bank scam.

The Emirates NBD Bank Payment Notification Scam

This is a textbook example of a fraudulent email.

Emirates NBD Bank
Dear media,
Greetings from Emirates NBD Bank
Subject payment as instructed by our customer to your company has been rejected by your beneficiary’s bank citing “Unable to apply to beneficiary account”.
Please check attached swift and confirm if the bank account details are correct and let us have an alternative to re-effect the payment immediately.
Thanks and regards,
Younes Ali
Head Teller
Jumeirah branch Al wasl road
Emirates NBD
Dubai
United Arab Emirates
Telephone
Email
Website

Opening the email’s attachment loads what is supposedly a Microsoft Excel document, but turns out to be an HTML file that will load in your default browser. A popup window then asserts that the document is protected by Microsoft File Security and in order to access it, you must enter your email address and email account password.

To the people in the know, this message ticks all possible check boxes needed to confirm that the email is fraudulent, and its sole purpose is to steal your credentials and deliver them in the hacker’s grubby hands. However, in spite of concentrated efforts to educate people on the matter, it seems that many still don’t know how to spot said red flags, which is why phishing campaigns are so effective and so damaging. In light of this, we have prepared a handy list of telltale signs that someone’s trying to defraud you, using emails such as those claiming to be sent by Emirates NBD Bank.

Obvious Signs of a Phishing Attack Everyone Should Always Look For

1. Unsolicited emails. This bears repeating – most entities that would attempt to get a hold of you over the Internet would not do so via unsolicited email. This is why people should automatically be suspicious of any unsolicited emails that end up in their inbox, and treat said messages with due caution.
2. Urgent messages. Emails that claim to be urgent or regarding a pressing matter, or with a time-sensitive nature, or claim that something bad has happened or will happen to you. If the message was so vital, the corporations and government agencies in question would have tried to get in contact with you via other, more expedient and reliable channels. As this is the case, messages claiming that something unexpected or unfortunate that can affect you has happened should be viewed with suspicion.
3. Suspicious sender. If an email claims to come from Amazon but is sent from a source that actually says “@amazzzon.eu”, then it’s almost certainly a phishing attempt. Always check to see if the email’s sender is legitimate.
4. Generic greeting. If you registered to service as George Wilson, you would never receive an email from that service that greets you as “Dear Customer”. Generic greetings are a telltale sign that what you have in front of you is actually a phishing email.
5. Suspicious attachments and links. You should always be on the lookout for email attachments that are out of place and obfuscated links, or links that seem to go to a different page than the message would suggest. In fact, it’s a good rule of thumb never to download a file or follow a link found in an unsolicited email, or an email whose sender is not absolutely 100% verified by you personally.
6. Messages asking the receiver to share or otherwise input important information. Companies would never ask for your personal details more than once. If you ever get a message claiming that you need to re-submit those, or that you need to log in to verify something – there is every chance that a fraudster is responsible for the message.
7. Unprofessional looking messages. If the message is poorly formated, edited, or has grammatical or spelling errors - you should automatically be suspicious of its veracity.