Watch the video
The police publish a video of the fraudster. He claimed to be a bank employee
–
The ubiquitous phishing scams are something we are already used to. It is difficult to find a person who has not received a fake SMS, e-mail or missed call at least once from a number usually originating from one of the African or Asian countries.
Criminals every now and then start with new attempts to trick inattentive Internet users, constantly improving the methods known for years. Now we are dealing with an attack in which the criminals are impersonating a known one bank (that’s also nothing new), but they do it with unprecedented precision.
You can find more about phishin attacks on the Gazeta.pl home page
They carefully prepared a fake mBank website
The Computer Security Incidents Response Team of the Polish Financial Supervision Authority (KNF CSIRT) warned about the new scam. Criminals prepared a special website, almost perfectly imitating the appearance of mBank’s transactional service.
At first glance, both the interface and graphic design of the website, as well as the link, do not raise any objections. The fraudsters even took care of the SSL certificate, thanks to which a characteristic padlock icon is displayed next to the address bar. The fact that we are dealing with a phishing attack reveals one detail in the website address. Instead of the letter “a” in the name “mbank” there was an almost identical character, but with a small dot below “a”.
We warn you against a fake website pretending to be mBank. Criminals use a special character encoding to cheat (…), which makes the fake domain similar to the real one. Be cautious!
– we read in the CSIRT KNF tweet.
The goal of cybercriminals is, of course, to wipe a potential victim’s bank account. Internet users may be directed to the website from various sources – for example from advertisements from search engines Internet or false e-mails pretending to be other, well-known companies or institutions (e.g. couriers or telecommunications operators). A crafted website steals login details instead of allowing actual access to the bank’s transaction service.
To protect yourself from this type of scam, we recommend that you take extra care when clicking on the web and double-check that you are actually dealing with a website of a company you trust. You also need to log in to the transaction website from your own (secure) computerby manually entering the bank’s website address or selecting it from saved tabs.
–
