Who doesn’t love an Easter Egg? Easter chocolate somehow tastes better than normal chocolate bars. So, when I got an inviting email with pictures of Easter Eggs and the promise of a £100 Asda gift card, the urge to click was strong.
Of course, this was yet another email scam and here is how I knew why.
Firstly, the email from line states it is from “Asda Gift Card” but expanding < > to see the full email address shows it is not asda.com; there isn’t even an attempt in this scam to disguise the email address. Often, phishing emails will disguise the from email address so that it looks at least somewhat like the address you’d expect.
Secondly, there is no salutation. The email is impersonal. Most large organisations now take the advice of the Anti-Phishing Working Group (APWG) about how to prevent their customers from being phished. This advice includes sending out emails from your organisation that are personalised.
The whole look of the email was less than professional, with no brand sign off by Asda and no Asda branding at all other than a poorly put together “Asda corporate address” – sure signs that phishing was afoot.
The Phishing Tricks That Engage Us
Scam emails are really good at manipulating human behaviour. They work at a primal level to create a compelling reason to click a link. This email has it all.
It uses gamification to encourage the click. The email asks you to click on an egg to see if it contains the £100 gift card. Who can resist!
It has a sense of urgency, “Hurry! this giveaway ends today!”
Urgency and fear of missing out (FOMO) are key giveaways in the game of phishing.
Scams and Holidays
Scammers love to use holiday times to scam people. Periods such as Christmas and events like Black Friday and Cyber Monday are used to propagate scam emails and other forms of scams. The promise of free money in the form of a gift card is one of the favourite tricks of the cybercriminal. In fact, holiday time based ‘ecards’ like the one in our email below, account for around 25% of the successful phishing scams.
What is in Those Phishing Links?
There were several links in the scam email all of which originated from the same domain site. When we ran an analysis of these links (see below) the results showed that the site the URL pointed to was likely infected with malware, including a possible keylogger. Keylogger malware is used to steal items like login credentials by sending the keystrokes you use when typing straight to scammer central.
So, if you think an email may be enticing, think again, and double-check before you click.
Why not help your colleagues stay safe and send them this little reminder. Feel free to edit, copy/paste the advice below:
The Asda Gift Card Scam
An email with an offer of a £100 Easter gift card might pop into your inbox this week. It has an image of Easter eggs and is pretending to be a competition to win £100 in gift cards. This is NOT from Asda and it is a phishing email. If you click on the image in the email or any other link it will take you to a spoof site. This site is likely infected with malware which could infect your PC.
If you receive an email like this or something similar – DO NOT CLICK ON ANY LINKS!
© 2023 . The Defence Works. All rights reserved.