Tricksters in white lab coats and phishing emails: Be wary of coronavirus-related scams, officials warn

[Olde Hornet]

Tricksters in white lab coats and phishing emails: Be wary of coronavirus-related scams, officials warn

Officials nationwide are warning residents to be wary of potential coronavirus-related scams targeting people gripped by fear in a global pandemic.

www.usatoday.com

Police and government officials nationwide are warning residents to be wary of potential coronavirus-related scams that target people gripped by fear during a global pandemic.

U.S. Attorney General William Barr on Friday issued a statement “urging the public to report suspected fraud schemes related to COVID-19.” Included in the statement were a list of potential schemes the Attorney General’s office is aware of, including phishing emails, malicious websites, and illegitimate or non-existent charities.

Not mentioned in the list of potential schemes but circulating on social media is the threat of people in white lab coats approaching homes, pretending to be from a state’s health department or the Centers for Disease Control and Prevention. In Florida, the Daytona Beach Police Department and the Palm Beach County Sheriff’s Office have both posted warnings about such a scam.

 

[Olde Hornet]

Why coronavirus scammers can send fake emails from real domains

https://www.vox.com/recode/2020/4/2/21202852/coronavirus-scam-email-who-spoofing-domain-dmarc

On March 18, an email went out from the World Health Organization soliciting donations for its Covid-19 Solidarity Response Fund, to support WHO’s work tracking and treating the novel coronavirus. The sender address was “donate@who.int,” and who.int is the real domain name of the organization.

But the email is a scam. It was not sent from the WHO, but from an impersonator looking to profit off our tendency toward generosity during a global crisis. Fortunately, the attacker revealed themselves by asking for donations in bitcoin.

This is just one of many fake emails that have spoofed the WHO’s domain name during the coronavirus pandemic. Some are addressed from Tedros Adhanom Ghebreyesus, the director-general of the WHO, and carry attachments that can install malware on the victim’s device. Others announce a coronavirus cure that you can read all about in the attachment. They each appear to be sent from a who.int email address.

If it seems like it shouldn’t be this easy to impersonate a leading global health institution, you’re right. As we outline in the video at the top of this post, there is a way for organizations and companies to prevent spoofing of their domain, but the WHO hasn’t done it.

“One of the things that a lot of NGOs and nonprofits don’t necessarily understand is that email is a very open protocol by design,” said Ryan Kalember, who leads cybersecurity strategy at Proofpoint.