Cybercrime Tweets

Scammers are now using Twitter as their new platform. They use Twitter to lure in individuals looking for customer support, by interjecting themselves into legitimate conversations the customers are having with their Financial Vendors, and offering friendly chatter and a link that directs the customer to a Phishing page designed to harvest their financial credentials.

 Who are the targets?

The scammers are focusing on finanical insituations that have interacted with their customers through social media. The attack occurs right after financial companies tweet to their customers. The cyber criminals interact with finanical insituation's customers, their answers vary due to different questions being asked and before they end the conversation, they direct the victim into taking "additional measures". 

Examples

Who are the targets?

On Twitter, someone – or perhaps a group of people – are following support accounts for large financial institutions and watching their interactions with customers. Depending on the question(s) asked, the scammers respond to the customer (usually after the official account has) and direct them to take 'additional' measures.

 Examples

Here are two examples of this cybercrime being committed:

1. NatWest is a large commercial and retail bank in the U.K.  A customer who had login problems with their NatWest account was assisted by the NatWest official customer service associate. Two hours after the officicial assist, the scammer directed the customer to a website and asked them to verify their login identity so they could "reset their password".

2. The second victim was a customer of a large British bank (Nationwide Building Society). The victim was asking about a special cash back promotion. The customer received an answer back from the Nationwide Customer Service officials, and then the scammers continued the conversation. The attack involved a link requesting the customer to "validate their account" to check their cashback offers.

How is it done? 

The scammers interact with unsuspecting customers by making their messages look convincing (social engineering).  By using twitter names that seem to mimic the real financial support accounts and adding other variables to make it seem like they're genuine and authentic. 

What the banks have done?

The banks continue to send out warnings to their customers. 

Ways to prevent this from happening from you!

1. Don't give out sensitive information to anyone even through verified public channels that seem to have customer service or customer support.
2.  Do not accept URL links. If a URL link is clicked, and you are brought to a fishing page, contact your bank immediately and change all of your log in information.
3. If your account is hacked, go to the bank right away or make a phone call to the bank as soon as you know and ask what you should do next. 
4. Social media is a great place to contact businesses that meet your personal needs but be wary of any potential attacks such as URL links that require personal log in information. 

Sources:

1. https://blog.knowbe4.com/scammers-phishing-for-financial-credentials-on-twitter?utm_source=hs_email&utm_medium=email&utm_content=50247376&_hsenc=p2ANqtz-9RxRZfwh9lVpLr2uoKYNbTT_cwagzEeSlZMt8BX_fgpaBIV8U78ScT2dmwkflcz8CSMdG2lDQ6euC0SKVgulQuhTZsVg&_hsmi=50247376

2. http://www.csoonline.com/article/3187832/security/scammers-phishing-for-financial-credentials-on-twitter.html?