Fraudsters are increasingly using all the information available about their victims, abusing them for personalised and hence particularly credible attacks.
If you are planning a holiday, you will often be using online platforms such as Booking.com, with almost all communications handled via digital channels. The problem: If booking data end up in the wrong hands, they can be abused for targeted attacks – for instance for credible phishing messages on purported booking changes. This is something the Bundesamt für Cybersicherheit (BACS) also warns against.
There is other information provided to communication partners, too, which is then used by cyber-criminals to ensure scams appear as credible as possible. A couple from Geneva recently fell victim to a scamming attempt when a man rang purporting to be a bank employee, using the real name of their account manager and other information about the couple’s relationship with the bank.
There are various ways in which fraudsters obtain such information. In the case of Booking.com, customer data were compromised during a cyber-attack. In other cases, criminals use publicly available information about their victims, for instance on social media such as Facebook, Instagram or LinkedIn or those provided on company or association websites. Using fabricated scenarios which appear very realistic, for instance citing fraudulent bank transfers and psychological pressure (“You must act immediately!”), the perpetrators lend credibility to their scams.
How can you protect yourself?
- Always remain wary if a financial institution or online provider is suddenly contacting you – especially if you are being urged to act quickly. In case of doubt, return their call using official telephone numbers to check the authenticity of their request.
- Never pass on credentials, PIN codes, credit card data or other sensitive information via telephone, e-mail, WhatsApp or in person. Under no circumstances click on any links, open any attachments or enter any credit card or banking data on linked pages.
- If you suspect transactions are fraudulent, immediately have your cards and accounts blocked. To do so, only ever use the financial institution’s official hotline number.
- Only provide as little information as possible about you and your family members on the Internet – remember: Every bit of information published can be used against you.
