Here’s the cleverest phishing email I received so far this year, that nearly had me logging into my account.
Take a look, maybe you’ve seen it before. Its a new to me, and it almost worked. I’ll break-down why it fooled me, and explain why I think this is particularly cunning. Let’s start at the inbox. Here’s how it looked:
The point here is the inbox presentation was good enough to earn an immediate click, without me glancing at the preview window. Next comes the email itself…
In default view without downloading images it is again very minimalistic and already feels Apple from the grey background font and type. Plus the word density of Apple is high…reinforcing your belief it is from Apple. If feels right. Now for the images…
With images, nothing has changed, no distracting new information to process, it just feels more Apple… But thanks to a life-saving tool tip on hover, that most email clients now have, a bogus url was revealed, causing me to look up and now notice the sender is bogus too.
What Impressed me about this fear-based phishing scam is its simplicity. The really clever part is the social engineering to create urgency. The account change notice making it a red flag, and the date-of-birth detail, which somehow adds to the credibility of the notice, and then lets me, convince myself this is something I should worry about. I’m already doing all the work getting myself into a state about my account possibly being compromised, before I even click through. My attention is reduced, with fear coursing through my veins. There’s no convincing to be done on the inside. The less said the better, and conveniently Apple.
By dropping the name salutation (which I didn’t even notice) they don’t even need to know your name, just email address. This gives them amazing flexibility and reach. They don’t even have to steal or phish the emails they use, they can scrape “just emails” by the boatload with no trickery required. And they don’t even need to care if you have an Apple account, roughly one in three of us in the US do. Can you imagine spamming 10 million people and getting a 20-30% open rate, you’re gonna get click-thrus for sure!!
Apple ID and password are quite prized by hackers, because those credentials open doors to other things!
