Semalt: The Most Sophisticated Tricks Used By Cybercriminals To Get Access To Your Email Account

1. 23.05.2018 Semalt: The Most Sophisticated Tricks Used By Cybercriminals To Get Access To Your Email Account It's 2017 and the threat of someone taking over your email account is real. Very real. Somebody at this moment is being tricked into handing over the access of their email to a stranger. In other words, attackers are compromising Yahoo Mail, Gmail and Hotmail accounts with a little bit of social engineering and a text message. Ivan Konovalov, the Semalt Customer Success Manager, states that the most effective scams are very easy to execute. Take the example of a con who dresses up as a cop. If he or she stopped you and ordered you to get out of your car and hand over the keys, would you decline? Of course not. The average person would do so without asking a question. It is no surprise that impersonating a cop is one of the most serious offenses everywhere around the world. The police scam has two things going for it: it is simple, and people tend to trust authority ?gures. These are the qualities that cybercriminals use. Of late, a trend has emerged. It's a spear phishing scam targeted at mobile users. The aim of this scam is to gain access to your email account. It's a simple social engineering attack which millions of people are falling for. A hacker (bad guy) only needs to know your email address and phone number. Surprisingly, these are easy to obtain. They take advantage of the two-tier authentication system offered by most email service providers. https://rankexperience.com/articles/article1179.html 1/2

2. 23.05.2018 This system allows users to reset their passwords by having a code or link sent to their mobile number. A classic example of the scam in action: Gmail account takeover In this case, there are two parties: Anne (owner of the Gmail account) and Dan (the bad guy). Anne opts to register her number with Gmail so that whenever she gets locked out of the account, a veri?cation code is sent to her mobile number. Dan, on the other hand, has stalked Anne and knows her mobile number (perhaps from her social media account or from anywhere else online). The bad guy (Dan) wants to gain access to Anne's Gmail account. He knows her username but not the password. He enters the username then clicks 'need help' after guessing a password. He clicks "I don't remember my password," enters Anne's email address followed by getting veri?cation on my phone. A six-digit veri?cation code is sent to Anne's number. Dan sends a text message to Anne claiming that he's a technician from Google and that they've noticed unusual activity on the account. He requests her to forward the veri?cation code so that they sort the problem. Anne believes that this is a legitimate, forwards the veri?cation code. Dan uses this code to get access to her account. When the Dan gets access to the account, he can do anything including resetting the password and changing the recovery option. That's a complete takeover. What follows next is unfathomable. To be safe from this scheme, never give veri?cation codes to anybody. In fact, if you've not requested for the same then note that somebody is up to no good. https://rankexperience.com/articles/article1179.html 2/2