Phishing

What is a Phishing scam?

Phishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords and credit card details, often for malicious reasons.

Not all phishing attacks require a fake website or email. Doing this via a phone call is known as voice phishing or vishing. Users are often lured by communications purporting to be from trusted parties such as social web sites, auction sites, banks, online payment processors or IT administrators.

How is it done?

How do I spot the signs?

 1. Mismatched and misleading information

– Emails: Look out for a sender’s email address that may look similar to a company’s official email address. Hover your mouse cursor over links in emails. When your mouse cursor hovers over a link, a small window will appear above the link to show you the actual URL, which is the real destination of the link. If the links are mismatched, it is a strong indicator that something ‘phishy’ is going on.

– Mobile device: Long-press the link to display a window with the actual URL. Be careful not to tap and open the link!

– Websites: Cyber criminals can easily create phishing websites that are visually similar to legitimate websites. To distinguish the two, take note of the URL in the address bar of your web browser.

 2. Requests for confidential information

The bank will never ask for your personal information such as NRIC, login credentials and credit card details to be sent over the Internet. If the sender claims to be from the bank and requests for your bank account number, it should raise a red flag immediately.

 3. Suspicious attachments

Cyber criminals include attachments in their emails as a method to infect a user’s device with malware and steal their data. Look out for suspicious attachment names and file types. If the attachment is for something you have no recollection of or uses an uncommon file type such as .exe, trash it.

 4. Unexpected emails

Cyber criminals often test their luck by sending mass emails to large groups of people, in hopes that someone responds. If you receive an email about an invoice for an item you did not purchase, do not click on the links and attachments and delete the email immediately.

Sample of phishing email and SMS

What should I do if I’m a victim of a phishing scam

 – Change your password immediately. If the revealed password is used on your other accounts, change those too. Be sure to use a different password for each of your online accounts.

 – Run a full system scan with your anti-virus software if you have clicked on a link or opened an attachment.

 – Call the bank if you have revealed your banking details or credit card credentials.

 – Keep an eye on all of your accounts for suspicious activity such as unauthorised purchases or withdrawals.

 – Lodge a police report if you incur any monetary loss.

 – Report the phishing attempt to the Singapore Computer Emergency Response Team (SingCERT) at singcert@csa.gov.sg.

How do I stay safe?

Tip #1: Only access our banking services via our official website

Our official domain and sub-domains includes:

Check that you are using the official Standard Chartered website in two steps

Step 1:

Type the Standard Chartered URL directly in the address bar of your web browser on your desktop or your mobile phone and look for the padlock icon beside the address bar.

Step 2:

Click on the padlock icon and a drop-down window will appear. If the drop-down window displays that the security certificate of the website is valid, it means that the Standard Chartered page you are on is valid and will encrypt any information you enter on the page.

Note: We also encourage you to use the latest versions of web browsers available, which may provide advanced security features such as anti-phishing and forged website identification. If such features are available, you are advised to turn them on.

Sample of the padlock:

Tip #2: Never click on suspicious URLs in emails or SMS

Verify the URL that is on the messages. The Bank will only use sc.com as our main domain.

Watch out for any SMS or email which pleads for assistance, invokes a sense of fear, urgency or curiosity. This might be a phishing attempt to steal your personal information or commit fraud.

Tip #3: Use the Push Notifications in the SC Mobile app

Make use of the in-app push notifications in the SC Mobile app to get notified via a secure channel.

Learn to avoid becoming a victim by taking the anti-scam quiz by the National Crime Prevention Council.

Sources:

https://www.csa.gov.sg/gosafeonline/go-safe-for-me/homeinternetusers/spot-signs-of-phishing