Fake faxes, voicemails and invoices — Logical Cybersecurity

Real World Examples of Social Engineering Attacks

Social engineering is basically defined as manipulating people into giving up confidential information. Social engineering can occur in person, by phone, or electronically (phishing email, fake website, etc.) and is the easiest way to breach a company, network, computer, etc. Your network and/or devices can be extremely secure, but clicking on one malicious link or attachment within a phishing email, visiting a malicious website, downloading a malicious app/program/file, or allowing a malicious person physical or virtual access to your device and/or office can slice right through your security. Attackers have found clever ways to use human nature against us to trick us into clicking something, revealing private information or allowing physical or virtual access to things we wouldn't normally do. We will go over some common warning signs to look for, provide ways to prove the legitimacy of an email, verify someone's identity, as well as provide examples of actual, real world social engineering attacks to help you better protect yourself, your family, friends, and clients/customers.

We have to be especially mindful when receiving emails regarding faxes, voicemails, and invoices. Here are a few examples of a rash of emails claiming the recipient has received a FreeFax, a voice message, or an E-invoice from Microsoft.

The ruse of sending “faxes”, “voicemails” and/or “invoices” has been used by phishers for a while now. If you receive emails stating there is a link to or an attached invoice, fax, or voicemail, proceed with extreme caution as these types of emails are often used to spread malware. If the email is from an email address/sender you don’t recognize, my suggestion is to delete the email and move on. If you do receive invoices, faxes, or voicemails via email on a regular basis, take a few seconds to analyze the email and compare it to emails previously received you knew were trustworthy.

Look for the following discrepancies when comparing:

Is the sender/email address the same? Even if it is the same, continue analyzing the email to make sure the email address/sender wasn’t spoofed.
Is the signature block the same?
Does the fine print at the bottom match (copyright or privacy warning)?
Is the format of the email the same?
- Look for format differences in
  - Wording either in the body or subject.
  - Style either font or layout.

Below is a sample of a few of the senders/email addresses and subject lines used. The email addresses are "spoofed", meaning they are faked to appear to come from the senders and email addresses listed.

Below are 3 examples of emails with the malicious links or attachments.

Below are examples of what happens if you did click links or open attachments.

Logical Cybersecurity

Logical Cybersecurity

Real World Examples of Scams and Phishing Emails

Logical Cybersecurity

Real World Examples of Social Engineering Attacks