Bitcoin, a type of cryptocurrency, has become hugely popular for financial dealings. That simple fact has set phishing scammers on fire trying to find new ways to separate bitcoin owners from their cryptocurrency. Online wallets, acting as a bank for bitcoin, are popular phishing targets for hackers. A recent study by Cisco shows one scam called Coinhoarder netted over $50 million in cryptocurrency over a three-year period. That explains the popularity among phishing scammers–it works.
December 2017 saw the price of bitcoin at $17,000, up from $6,000 the month before. Anytime a market jumps like that, you can be sure that cybercriminals see $$ signs and figure out a way to get a piece. It’s not that difficult for a seasoned phisher to put thousands of lures out there, and then just sit back and wait for a bite.
As the popularity of bitcoin grows, hackers use more and more sophisticated phishing exploits to get at cryptocurrency wallets. Fake emails and websites give trusting wallet holders a quick way to hand over their passwords and credentials. Once that happens, a bitcoin wallet can be cleaned out in a manner of seconds, leaving very little to no way of tracing the culprit.
One attack included a three-tiered approach to email phishing for bitcoin. The first email alerted the crypto account holder that a security update for their account was necessary; just a simple notification that didn’t include anything to raise suspicion. The bitcoin holder checking the email address of the sender believes it’s a legitimate email from the wallet service. Unfortunately, it was a spoofed address, which means the sender made it appear as if it was a legitimate source. This is shockingly simple to pull off. After that, the wallet holder’s guard is down, assuming all following emails and links are legitimate as well.
Through cyber trickery, two more emails follow the chain. One prompts the account holder to click “Log In.” The third and final email is where account passwords and other sensitive information is required by the holder. Once that data is obtained, within seconds their cryptocash is gone. Bitcoin holders falling for fake security updates results in losing all their cryptocurrency security.
Always second-guess any email message or even text message that includes a link, whether or not you know the sender or even if you’re expecting something. The phishers are getting so sophisticated that it’s nearly impossible to tell if a link is malicious these days. A quick check is to hold the mouse pointer over the link for a few seconds. That will bring up the entire link. If it doesn’t make sense, is shortened using a service such as “bit.ly” or just looks like junk, it’s probably not something you want to click. For mobile devices or other touch screens, hold your finger on the link for a few seconds to see the entire link. Just be careful enough to hold it down long enough or it might just click it instead.
Sophisticated phishers know that security is a huge concern for cryptowallet owners. Taking advantage of any vulnerability is what cyberthieves do. Unfortunately, they’re profiting while doing it.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
