Disease outbreaks typically result in a surge of email phishing scams, and experts say to stay vigilant.
On March 2, the World Health Organization (WHO) issued a warning that email scammers are taking advantage of the spread of COVID-19 by claiming to be WHO officials in order to gather sensitive information and steal money.
A notice on the WHO website said that the organization will never email individuals asking for private information.
“Beware that criminals use email, websites, phone calls, text messages, and even fax messages for their scams,” the website read.
The World Health Organization will:
never ask you to login to view safety information
never email attachments you didn’t ask for
never ask you to visit a link outside of www.who.int
never charge money to apply for a job, register for a conference, or reserve a hotel
never conduct lotteries or offer prizes, grants, certificates or funding through email
never ask you to donate directly to emergency response plans or funding appeals.
Jeff Thomson, a senior intelligence analyst at the Canadian Anti-Fraud Centre (CAFC), said in an interview that no Canadians are known to have been affected by the COVID-19 phishing scam yet, but isn’t surprised that scammers are using the health outbreak as a way to get information and money.
“The fraudsters are quite good at grabbing stuff, whatever’s new and happening in the world that has a public interest or where mass populations can be following this,” he said.
Thomson said that because these events are known to the public, fraudsters are able to create “a story that is more realistic” when sending emails.
According to 2019 data from the CAFC, phishing scams in Canada rank third in types of scams sent to individuals. In the past year, these types of scams resulted in a loss of nearly $300,000.
Stephanie Carvin, a security expert and assistant professor at Carleton University, said in an interview that there was no surprise in the correlation between a spike in phishing email scams and times of panic and concern.
“Imagine if [a scammer] pretended to be a doctor and you sent emails [that said] ‘We think you’ve been in contact with someone with COVID-19, please fill out this form because we need to contact you,’” Carvin said. “The way these scams work, and what makes them impressive is that they try to instigate a sense of panic.”
She explained that particularly when there is a health outbreak, scammers will capitalize on what people are scared of and will send emails related to a person’s fears. The hope is that they click on it to obtain more information.
“[COVID-19] is in the news, people are scared and you can manipulate them. It’s really unfair in scary ways,” Carvin said, adding that the fear is what motivates people to give up personal information and private details.
Thomson noted that the email phishing scams as a result of major crises “came to the forefront” shortly after the Hurricane Katrina disaster took place in 2005 in New Orleans.
He said that if you get an email that asks you for personal information, do not reply and contact the CAFC to report it.
“If an email is creating a sense of an urgent situation, there is panic or fear and you need to click on a link… that is a good indication of fraud,” he said. “What we’re really trying to get people to do is not react.”