Tag: Impersonation

Posted on by

Counterfeit software update notices that exploit routine maintenance habits

Software updates have trained users to do something useful: when a trusted program says it needs a security update, install it.

That routine is valuable enough to steal.

Mozilla documents fake Firefox update pages that interrupt browsing with warnings about an “important,” “urgent,” or “critical” update. Some arrive through advertisements or redirects. Others claim Firefox requires a manual download and try to convince the user to install malware or a malicious extension.

See Mozilla’s warning about fake Firefox updates.

The scam borrows authority from maintenance

The page does not need to explain why the user should trust an unknown executable.

It presents the file as something the browser itself already needs.

That collapses two separate decisions into one. The user thinks, Should I update Firefox? The actual question is, Should I run a file offered by this unrelated webpage?

Those are not the same transaction.

Mozilla notes that Firefox normally updates through its own automated mechanism. A random webpage demanding that the user manually download and execute an update is therefore a warning sign, even if the page uses the correct logo, browser name, and security language.

Check from inside the real product

The safest verification route is usually boring.

Ignore the page. Open the application’s own update function, operating-system package manager, official app store, or publisher website that you reached independently. If an update is genuinely required, the trusted channel should be able to confirm it.

Do not save or run an unsolicited installer merely because a webpage says the situation is urgent.

The important distinction is where the update instruction originated.

Real software maintenance is part of the relationship between the user and the software publisher.

A counterfeit update notice inserts a stranger into that relationship and hopes the user will not notice the handoff.

Posted on by

Business email impersonation and fraudulent payment changes

The dangerous invoice is often not the obviously fake one.

It is the invoice that arrives in the middle of a real business relationship and changes one small thing.

New bank details.

Business email compromise, or BEC, works because the attacker borrows an existing relationship between a company and a supplier, executive, employee, customer, or contractor. The message may refer to real work, real names, and a payment the recipient genuinely expects to make.

The fraud appears in the instruction telling the recipient where the money should go.

The FBI specifically warns businesses to verify changes in account numbers or payment procedures and to confirm transfer requests through another channel.

See the FBI’s Business Email Compromise guidance.

Familiar context does not authenticate a new bank account

A fraudulent message does not have to invent the entire transaction.

An attacker who has compromised an email account, studied public information, or learned the normal rhythm of a business can wait for the moment when a payment is expected. The request then feels routine because most of it is routine.

That is why a sudden change in payment instructions deserves its own verification step even when everything else in the message looks correct.

The FBI recommends verifying payment and purchase requests in person when possible, or by calling the person through a known number. Its older BEC guidance makes the same point: confirm vendor payment-location changes and use previously established contact information rather than whatever number appears in the suspicious message.

See the FBI’s earlier BEC prevention guidance.

Verify the change outside the message that requested it

If a supplier says its bank account changed, do not verify the change by replying to the same email thread.

Use a phone number already on file, an established vendor portal, a known contact, or another trusted channel. For larger transfers, a second employee approval can make one compromised inbox much less useful to an attacker.

Urgency is another warning sign. An attacker benefits when the normal verification procedure suddenly feels too slow for this one special payment.

The key distinction is simple.

A real invoice proves that money is owed.

It does not prove that a newly supplied destination account belongs to the company that earned it.

The relationship may be genuine.

The last line of the payment instructions may not be.

Posted on by

Tech-support scams that turn an alarming pop-up into remote access

The pop-up is not the main event.

The remote-control session is.

The Federal Trade Commission describes a common tech-support scam in which a bogus warning claims the computer has a virus or other serious problem and tells the user to call for help. The supposed technician then asks for remote access to the computer, pretends to diagnose an infection, and sells an unnecessary repair or uses the access for something worse.

See the FTC’s guide to tech-support scams.

Remote access changes the problem completely

Before remote access is granted, the scammer has a story.

After remote access is granted, the scammer may be able to see what is on the screen, manipulate files, install software, observe passwords, or guide the victim through banking and payment steps while appearing to “fix” the machine.

The FTC has brought cases involving operators who used frightening pop-up advertisements, claimed affiliation with Microsoft or Apple, and persuaded people to allow remote access. Once connected, the operators pointed to harmless system information as supposed evidence of infection and sold unnecessary services.

See the FTC’s 2019 refund announcement involving a tech-support operation.

The crucial move is therefore not the fake scan. It is the transfer of control.

Break the chain before the technician becomes “trusted”

If an unexpected warning tells you to call technical support, do not use the number in the warning.

If someone contacts you unexpectedly and says your computer has a problem, do not give that person remote access.

Instead, close the message and contact the software vendor, device manufacturer, employer help desk, or another trusted technician through contact information you obtained independently.

Microsoft states that it does not make unsolicited calls offering technical support and that genuine Microsoft error messages do not include phone numbers telling users to call.

See Microsoft’s tech-support scam guidance.

A convincing scammer may know real technical terms. The remote-access program itself may also be legitimate software commonly used by actual support departments.

Neither fact proves the person on the other end should control the machine.

The authority has to be verified before access is granted, not after the stranger is already moving the mouse.

Posted on by

Fake customer-support accounts that intercept requests for help

Posting a public complaint can accidentally create a customer-service wanted ad for scammers.

You identify the company. You describe the problem. You reveal that you want help now.

The impostor only has to answer first.

In 2024, the Federal Trade Commission warned that scammers were monitoring social media for travelers complaining about airline delays and cancellations. Fake customer-service accounts then contacted those travelers pretending to represent the airline.

The scammers asked for booking information, phone numbers, bank details, or directed victims to spoofed websites.

See the FTC’s warning about airline customer-service impersonators.

The scammer already knows the problem

This attack has an advantage over a random phishing message: context.

If you just posted that your flight was canceled, an account replying with “We can help with your rebooking” does not have to guess what will get your attention.

The public conversation supplied the script.

A copied company logo, a support-sounding username and a polite reply can be enough to move the conversation into direct messages, WhatsApp, text messages, or a fake form where the requests become more sensitive.

That is why apparently relevant information is not proof that the responder is legitimate. The scammer may know the details simply because you posted them publicly.

Verify the channel, not the tone

The safest way to confirm support is to approach the company independently.

Open the airline, bank, retailer or service’s official website or app and find its support channel there. If the company lists official social-media accounts, follow those links from the company’s own site rather than trusting a username that looks close enough.

The FTC specifically recommends contacting airlines through their official app, website, chat, phone number, or an in-person representative. It also warns against sharing personal information over social media.

This matters because good manners are easy to imitate.

A fake support account can apologize, use your name and promise to escalate the case. None of that gives it authority over your reservation, account, refund or money.

Public customer service creates a strange asymmetry: everybody can see who needs help, but the customer may have difficulty seeing who actually has the right to provide it.

That uncertainty is exactly where the impostor works.