Gamification & Prizes as a Phishing tactic
Phishing attacks have mostly been defined as tactics that create a sense of urgency to the potential victim who is forced to make a quick decision without properly reviewing the phishing message. These messages usually imply removal of access, loss of service, termination of subscription, running out of space if immediate action isn’t taken, thereby reducing the victims diligence to review the message for proper language and most importantly the website address that they are taken to. These attacks would often use a popular brand such as Amazon or NETFLIX.
Other tactics that seem to be more popular within recent times, prey on emotions on the other side of the spectrum. One that seems to bring hope, joy and satisfaction to the victim through gamification and reward. The phishing scams outlined in this example also use popular brands but seem to be focusing on popular local entities such as the ones in this example; TTPOST, PriceSmart and Caribbean Airlines.
The image shows a comparison of two scams, which displays high degrees of similarities. The screenshots are intentionally placed side by side to assist online users from identifying these in the future.
Identifying traits of these are as follows:
- Facebook page with use of TT in the name that shares details of a giveaway that requires users to pay a nominal shipping or processing fee
- Details of the potential prize with a ‘too good to be true offer’ offered for a very low processing fee e.g. TT$15, TT$13
- A staged ‘pick the box’ process which makes the user feel that they are betting on their luck to find the prize, when in truth, a prize will ALWAYS be picked
- A congratulations screen displaying the prize which will always be significantly higher in value than the processing fee
- The actual phishing element of the scam where user data is requested
- A fake payment page.
NOTE the website addresses on each screenshot; at no point in time was it ever a TTPOST or PriceSmart website
If you encounter a Facebook page like this, report it to the platform. The Caribbean Airlines scam was reported and subsequently taken down.
If you happened to get tricked by this new phishing scam and reached the point of entering your credit card information, contact your financial institution immediately and cancel your credit card and have them review the most recent transactions on the card.