Vishing and Cybercriminals during COVID-19

The COVID-19 pandemic has resulted in an upshot of all types of scams.

In the midst of a pandemic, the website of the Champaign-Urbana Public Health District was hacked and infected with ransomware. Recently, the World Health Organization (WHO) warned it has seen a five-fold increase in the number of cyberattacks directed at its staff, and email scams targeting the public at large.

The Federal Trade Commission says that since January 2020 until mid-April, they received 18,235 reports related to COVID-19, and people reported losing $13.44 million dollars to fraud. The top complaint categories relate to travel and vacations, online shopping, bogus text messages, and all kinds of imposters. While reports of robocalls are way down overall, says the FTC, they’re now hearing about callers invoking the COVID-19 pandemic to pretend to be from the government, or making illegal medical or health care pitches, among other topics.

With all the talk about social engineering, phishing, and other types of cyberattacks, no one is talking about vishing – the telephone equivalent of phishing.

According to Daniel Norman, Research Analyst at the Information Security Forum, vishing attacks are a very cost-effective mechanism for manipulating individuals, using the voice to humanize the delivery and make the attacker seem more believable. “To ensure success, attackers build up profiles of their targets using a blend of Open Source Intelligence (OSINT) techniques, particularly online,” explains Norman.

“A surprising amount of information is publicly available to attackers, meaning they do not necessarily have to delve into the Dark Web in every reconnaissance mission,” says Norman. “When building these target profiles, attackers typically scour social media platforms, such as LinkedIn, Twitter, Instagram and especially Facebook, to gather as much public information as possible, as well as other associated websites, such as work or sports teams. Information found can range from home addresses to email addresses and even telephone numbers.”

Vishing scams often hook their victims with a legitimate piece of information, like a Social Security or bank account number, says Sam Rubin, Vice President at the Crypsis Group. “Often a partial number—like the last four digits of a Social Security number—is enough to do the trick. More elaborate scams (or more security-savvy individuals) may require more detailed personal information for vishing success,” he says.

Norman adds that by diving a little deeper into social media profiles one can build up a repository of information, such as what college the target attended, what qualifications they have or training they’ve done, what their favorite brands are, recent purchases and recent vacations… Automated screen-scrapers and other targeted machine learning technologies can all speed this process up tenfold.

“Social security numbers, bank account details and other more intimate information is slightly harder to find but armed with the right tools and contacts, it is easy,” notes Norman.