This weekend, I received a friend request on Facebook from my Great Aunt Betty.* She looks so strikingly similar to my late grandmother, that I get a flash of bittersweet melancholy whenever I see her. We had already been friends on Facebook for many years, but she is in her 80’s, so I didn’t think much of it. I figured maybe she couldn’t remember her password or she somehow lost her account, so I accepted it.
I was very pleasantly surprised when the next day, my Great Aunt Betty sent me a nice Facebook message, asking me how I was doing. She had messaged me a few times before that day, mostly just to wish me a happy birthday or ask about our side of the family. I told her my family and I were doing quite well, considering the circumstances. She told me she was pleased to hear that, and that she was just ready for life to go back to normal. I agreed, and told her I was pretty lucky that I was able to work from home.
Then she said something that gave me pause. She asked me if I had heard about the Small Business Association loans that were being given out.
This IMMEDIATELY set off red flags and alarm bells inside my head, while simultaneously making me feel a bit sad that I was most likely not talking to my actual sweet Aunt Betty, who reminded me so much of my beloved grandmother.
After all, why would my 80 year-old great aunt be asking me a question like that? I noticed, too, that there had been an odd grammatical error in one of her questions… I was definitely being phished.
I said that that was an awfully odd question, and that I didn’t think this is really my Great Aunt Betty. I asked the fake Aunt Betty, “If this is the real Betty, how do we know each other?”
I gave them a minute to answer; they didn’t. So I messaged the ACTUAL Aunt Betty and told her that she had been falsely impersonated. I went to the fake profile, and wrote a message that this is a fake account, in all caps, so that her elderly friends wouldn’t be tricked. After that, I reported the profile to Facebook, and told the fake account that they were really unfortunate in their choice of phishing expeditions (really, how ironic, considering what I do for a living!).
My real Aunt Betty messaged me back, thanking me, and we ended up having a very nice conversation.
The fake Aunt Betty quit messaging me, obviously. And as of today, when I went back to look at the conversation, the messages had been hidden by Facebook, and they stated they were awaiting verification that Aunt Betty was actually Aunt Betty… In other words, this has been taken care of by Facebook.
The Tip Off
If you have read the past blogs about malware and phishing, you probably understand what tipped me off. But if you haven’t, I’ll happily explain it to you.
The next step of the Fake Aunt Betty (FAB), had I not caught them, would have been to send me a link that is similar to the real web address. But this one would have been infested with malicious software; most likely ransomware, that I would have infected my device with. This is called phishing, and here are things to look out for:
- Be wary of duplicate accounts. It’s very easy to save a profile picture and create a new Facebook profile using the pilfered pic and name.
- Watch out for odd language and grammar. These are USUALLY Russian bots that are proficient in English, but have odd idiosyncrasies that are weird for native English speakers.
- DO NOT TRUST LINKS. If you haven’t heard from someone in a while, and they tell you to click on a link… DO NOT DO IT!!!
Trust your gut. If something seems off, it likely is.
Moral of the Story
As I’ve stated before, hackers have ZERO shame. Not only did they impersonate an elderly lady with elderly friends that the cyber criminals could potentially take advantage of, they also used the Coronavirus as a guise… Insult to injury.
Do you think your or friends, family or coworkers would have been able to spot the phishing expedition? While many probably would, just as many probably wouldn’t have, which just highlights the importance of cyber security training. If you or anyone else you know could have been fooled, feel free to contact us. We offer comprehensive training practice, which includes faux phishing bait, to see if your employees would spot the fake or not. Feel free to give us a call at 919-422-2607 to answer any questions you may have, or schedule an appointment free, online.
You can never be too safe… Do NOT underestimate the hackers’ absolute lack of shame.
*Name changed to protect the victim.