Common Phishing Scams

Scenario/Method: Vishing Scams Use Phones Instead of Fake Websites
In a new twist, identity thieves are sending spam that warns a potential victim that his or her financial institution or PayPal® accounts were supposedly compromised. However, unlike typical phishing e-mails, there is no website address in these phishing messages. Instead, the victim is urged to call a phone number to verify account details. The automated voice message says: “Welcome to account verification. Please type your 16-digit card number.” The goal is to get you to enter your credit card number. In these reported scams, no mention of the credit union, bank of PayPal is made. In some instances, the caller may already know the recipient’s credit card number, which increases the recipient’s perception of legitimacy, as the caller asks for the valuable three-digit security code on the back of the card.

Scenario/Method: Customer Survey Phishing
The spam e-mail starts with: “The Online department kindly asks you to take part in our quick and easy 5 question survey. In return, we will credit $50.00 to your account – Just for your time!” The e-mail goes on to describe how it only takes two minutes and your answers will help them. The web page itself and the initial questions are designed to look authentic. Of course, the spam doesn’t really take you to a financial institution’s website. Instead, it takes you to a scammer’s site in China, Russia, Romania or wherever. The catch is that in order to credit your $50 reward, they need your personal account and other private information, including ZIP code and mother’s maiden name.

Scenario/Method: The Jury Duty Scam
The scammer calls alleging to work for the local court and claims the potential victim has failed to report for jury duty. The caller tells the victim that a warrant has been issued for their arrest. The victim will often rightly claim they never received the jury duty notification, which the scammer will then ask the victim for confidential information for “verification purposes.”

Source: CUMIS (Credit Union Management Information System), Vishing scams - 7-25-06