Have you received an email with an attachment that’s corrupted? Before you fix the file, know that you could be reading a phishing email.
The fake file phishing attack
The scam starts off with an email, often with a legitimate looking email address, suggesting the message is from someone you know. The email might be marked as urgent, or high priority, and have an attachment (in this case, a word document).
The email requests that you download the attachment and review the information; the information might be about a bonus, or a proposal that you’re required to approve.
However, when you click the attachment, a pop up appears from Microsoft Word, informing you that the file is corrupted and asking if you’d like to use the recovery feature. When you click yes, the file is restored.
Opening the file reveals a QR code, which you’re prompted to scan with your mobile. That takes you to a login page; this might be for your Microsoft 365 account, or it might be your company’s internal login page. When you’ve entered your details, the scammer has access to your account - and anything that you have access to.
Why this scam is so effective
This scam brings together some of the most persuasive and manipulative techniques in a phisher’s toolbox; social engineering, a random QR code, and a fake login screen. Seeing an email land in your inbox that claims to be urgent is going to make you want to speed up, particularly if that email comes from your boss.
Remember, it is incredibly easy to spoof an email address, so that the sender appears to be someone you trust. This could be your bank, your company director, your accountant or your child. Just because the sender email looks right, it doesn’t mean that the email is legitimate.
There’s also no way to tell where you’ll be taken when you scan a QR code, and any safety procedures you have in place for URL scanners aren’t going to work. With a targeted phishing attack, being sent to something that looks like your employee login screen doesn’t raise any red flags. And once you’ve typed in your details, it’s too late.
What are the red flags?
This scam is very convincing, particularly if it is targeted, but there is a big red flag here. Can you imagine your boss sending you an email with a word attachment, where the word attachment is broken and needs repairing? And following this, the word document only asks you to scan a QR code, and the QR code takes you to your company’s internal login screen?
When you think about this scenario for more than a second, it makes no sense. An email from your company or someone you trust wouldn’t be attaching a QR code to a word document to ask you to login to your account; they would just let you know where the information could be accessed. If you’re looking at a scenario like the one above, it’s probably a scam.
Stay safe from phishing scams
-
Slow down
Social engineering scams like these are so effective because it plays on your desire to get something done quickly. When we’re working quickly, we’re paying less attention to the red flags that a scam like this presents. Slow down, take your time and think. -
Don’t download
When a file is corrupted, our recommendation is that you inform the sender that the file is broken - without replying to the email. There is just too much risk when you download a file that looks broken, even when you think that the sender is someone you know. Don’t download the attachment, and request the word document again directly. -
Go offline
This scam, like so many phishing scams, is so easy to detect if you take yourself offline. All it takes is a quick conversation with whoever has supposedly sent this email to refute it, saving you and your business hours of stress and panic in the process.
