eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
The chaos surrounding vaccines during COVID-19 is doing more than just making it hard to get a shot that could save your life. It’s also opening up an opportunity for cybercriminals to take advantage of the uncertainty surrounding vaccines to steal your personal information. All it takes is the right email.
According to Eric Howes, Principal Lab Researcher at KnowBe4, the criminals are attempting to look like your company’s HR department. “The majority of these emails spoof HR departments,” Howes said. “That’s no accident, as HR departments are going to be one of the key sources for employees to get vaccine information.”
Howes sent me copies of several emails that appear at first look to be legitimate communications from an employer. One email, ostensibly from a company HR department, clearly aims to steal employee credentials. In the body of the email, which was provided by Howes, you see, “Please sign in here to access your COVID-19 benefits” and explains that the company’s single sign-on feature is enabled. Of course, when the victim clicks on the link and enters their single sign-on credentials, they’re then harvested by the criminals.
Emails lead to credential-phishing attacks
“Most of these emails eventually lead to credentials phishing attacks,” Howes explained, “which are the most common payloads going these days.”
Howes said that an even more common approach is a COVID-19 tax survey email that appears as a text message. A warning by the IRS details how the scam works. “People get a text message saying they have received a direct deposit of $1,200 from COVID-19 TREAS FUND. Further action is required to accept this payment … Continue here to accept this payment …’ The text includes a link to a phishing web address.”
The IRS is working to track down the criminals in this case and details how to report such a text message in the warning, which involves taking a screenshot and sending it to them. There’s also a survey that purports to ask about reactions to a COVID vaccine that includes a link to a phishing site.
Unfortunately, the piecemeal approach by many states to providing vaccines is making the problem worse. Every state has its own method of contacting vaccine recipients to set up appointments. Worse, in some states, there are multiple methods for finding a source for vaccination and then getting on the list. This means that you have to be aware of the procedures used by your state, or in some cases your locality.
Guidelines to know
Still, there are some guidelines you should be aware of.
- First, unless you’ve registered for notifications about the COVID vaccine, your local or state government isn’t going to send you an email about it. Likewise, neither is a local mass vaccination site.
- Second, it’s unlikely that your HR department will reach out about vaccines, but if it looks as if they have, then don’t respond to an email or text message. Instead, call the HR department and confirm that the email is from them.
- While your health department may reach out to you to ask about potential reactions to a vaccine, they will do so only if you’ve provided them with your email or cell phone number. And if you’re in doubt, you don’t have to answer those questions.
- In addition, be aware of traits of phishing emails, which may include poor grammar, misspellings and odd word choices. And if your email that seems to be from the HR department comes from an outside address, that’s a red flag. It’s a scam.
- Also, find out what entity is actually managing the vaccine administration where you’re getting your shot. If you get a message from another entity, it’s probably a scam. For example, I received my COVID vaccines from the local VA hospital, so a message from my county asking about vaccine reactions would be a scam.
- Finally, the COVID vaccine is free. Anyone who is asking you to pay for the vaccine is running a scam, and worse, you may pay and not get the vaccine at all. While some localities may have an administration charge, that will be covered by insurance, and it will be clearly labeled as such.
The sad fact is that the process of vaccine administration has not been as well handled as it could have been. While the new administration has done a lot to smooth things out, the chaos from the beginning is still with us. Prepare for that, be suspicious of anything that asks for personal or financial information, and check to confirm that it’s legitimate.
But whatever you do, get the vaccine. It makes us all safer.