{"id":30058,"date":"2022-02-24T13:34:41","date_gmt":"2022-02-24T11:34:41","guid":{"rendered":"https:\/\/www.kaspersky.co.za\/blog\/reset-notification-scam\/30058\/"},"modified":"2022-02-24T13:34:52","modified_gmt":"2022-02-24T11:34:52","slug":"reset-notification-scam","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.za\/blog\/reset-notification-scam\/30058\/","title":{"rendered":"Password reset notification scam"},"content":{"rendered":"

Most online services have a built-in security system that alerts you when it detects \u201cunusual\u201d activity on your account. For example, services send notifications about attempts to reset the phone number and e-mail address linked to the account, or the password. Of course, as soon as such messages became commonplace, enterprising cybercriminals tried to imitate this mechanism to attack corporate users.<\/p>\n

Example of a fake notification<\/h2>\n

If it\u2019s a public online service attackers will usually make every effort to create exact copies of a real message. However, if attackers are hunting for access to an internal system, they often have to use their imagination as they might not know how the email should appear.<\/p>\n

\"Real<\/a>

Real example of a fake notification about a change of phone number.<\/p><\/div>\n

Everything about this message looks ridiculous, from the incorrect language to the rather dubious logic \u2014 it seems to be at once about linking a new phone number and about sending a password reset code. Nor does the \u201csupport\u201d e-mail address lend credibility to the message: there is no plausible reason why a support mailbox should be located on a foreign domain (let alone a Chinese one).<\/p>\n

The attackers are hoping that their victim, fearing for the security of their account, will click the red DON\u2019T SEND CODE button. Once done, they\u2019re redirected to a website mimicking the account login page, which, as you\u2019d imagine, just steals their password. The hijacked mail account can then be used for BEC-type attacks or as a source of information for further attacks using social engineering.<\/p>\n

What to explain to company employees<\/h2>\n

To minimize the chances of cybercriminals getting their hands on employees\u2019 credentials, communicate the following to them:<\/p>\n