Sometimes, life surprises you with a special moment that leaves an indelible mark on your memory. We experienced such a moment recently at the University of Michigan.

Our son’s graduation ceremony was held at the Crisler Center, the university’s basketball stadium. He was decked out in his regalia, and as we made our way there, strangers would stop to wish him “Congratulations!” . Cars honked, and drivers leaned out to shout their good wishes. It was heartwarming to see so many strangers cheering for a young person’s achievement.

After the ceremony, we hopped onto the university bus to head home. The bus was filled with other students and their families. Once everyone was on board, the driver stood up. He was an imposing, tall, and broad African American man whose head nearly touched the ceiling. He commanded our attention with his booming voice.

“Congratulations to all the new graduates!” he announced. Then he invited the graduates to come to the front of the bus. About nine or ten students made their way up and faced us. He asked them to share their names and departments, which they did one by one.
“Ladies and Gentlemen,” the driver proclaimed, “I present to you, the graduates of the University of Michigan!” The bus erupted in joyful applause at this impromptu celebration.

As the students beamed and returned to their seats, he continued, 
“Wherever you go, remember that you are the best among the best. But you don’t need to say so — let your work speak for itself. This is the U of M way: we come, we do the job quietly, and we do it well.
I am sure that U of M has made you better people. But I want you to know that you make U of M better, you make us better. And for that, I want to thank you all.
Remember, you will always be part of the U of M family. Wherever you go, when you see the big M, you know that you are home! 
Congratulations, and I wish you all the best! Go Blue!”

We were completely blown away by his speech. It made a bigger impact than any of the formal addresses by accomplished speakers at the commencement. It was a reflection of the work ethic that values quiet excellence, an expression of gratitude and service. It was genuine and heartfelt, and it spoke volumes about the attitude this bus driver brought to his job, the pride he felt in his institution and its people. Whether it is the American culture, or the UofM culture, or just the individual ethos, this is simply outstanding. Every person, no matter their role, has the power to make a meaningful impact. It is not the person’s status or wealth or education or any such parameter, but this work ethic and genuine concern for people that makes the difference.

We don’t know his name, and we didn’t take any pictures or videos, but the memory is crystal clear in my mind’s eye. It touched us to our core and made the moment truly special. In fact, this is probably the highlight of our trip. 

In this world of online digital commerce, cybersecurity is very important. Most of the breaches happen because the credentials are compromised – not intentionally, but through a phishing attack.  Phishing refers to the fraudulent practice of sending emails purporting to be from reputable companies to induce individuals to reveal personal information, such as passwords and credit card numbers. It can also be a used to get the victim to download malware or ransomware.

I recently received such a mail, and I am sharing this so people can look for signs in the mail or elsewhere, to recognize the phishing attempt.

The Ploy
Surprise the victim, create a sense of panic!  Here is a screenshot of the mail I received. I hadn’t made any purchase at 2:17 AM on 31^st March. The expected behaviour is that the victim will get flustered – did my account get hacked?

The victim is puzzled, now nudge him to open the document with the details.
This was the content of the attached doc

The clickbait is here: the hyperlinks “Report a problem”, or “click here” to cancel your purchase.
The unsuspecting victim is lured into accessing a phishing site where he/she may end up disclosing sensitive information like passwords or credit card details. Remember an Indian Payment Gateway is forced by RBI regulations to use OTP, but an international Payment Gateway will not come under the purview of RBI, and will allow the card to be used as long as all the details on the card are available.
***
So let me attempt and decode this phishing attempt. There are many tell-tale signs, and if you catch even one of them, you should be suspicious.

The email Header

Note that the logo shows “Apple Notice”. Genuine companies take every opportunity to reinforce their brand, and therefore if this was a mail from Apple, I would have seen an Apple logo instead of “A N”.
Look at the sender’s address. Even though you see apple.co.cl, be aware that it is not apple.com. The manage-support2839 is also a flag. Suspicious.
Click on the “more” in the header, and you will see

Note the misspelt “no reply” and note also that the domain is very different now! There is amazon.com towards the end of the string of letters, but this is not the same as receiving a message from <address>@amazon.com.  Suspicious!

The email body
The “Yesterday” was March 31, 2022, and the mail said the payment “will be made on Mar 30, 2022”!
Note that the mail does not refer to me by name, just a “Dear Customer”. If it was from Apple, they would surely address the customer by name.
If you have made purchases from iTunes or Apple Store in the past, you would have some idea about how the invoice is presented.  So pause and review whether the email looks genuine.
If you don’t recollect the genuine mail, then maybe you will go to the next stage and open the attached file.

The Receipt
Zoom in a bit : see the logo is not sharp – not a genuine Apple logo.
Look at the way the text is formatted. Companies take pride in the way they craft their messages, they don’t make such mistakes. Of course, one must be cautious that scamsters will get savvier and more polished and remove such errors.

Note that in a genuine document or email, all the items below would be hyperlinks, and not just plain text.

But the most important thing to remember : Do not click the hyperlinks. Hover the mouse over them – in this case “manage your password” or “click here to cancel your purchase”. In this example, I saw that the hyperlink was:

Note that the link now points to a site in New Zealand! Whenever you see href.li at the start of the URL supposedly sent by a reputed company, that should always be a red flag. Someone is trying to obfuscate and hide.  Best to stay away from it.  Mark the email message as Spam.

If you are looking at such a document on a mobile phone, a long click on the URL should show you the link. If it doesn’t show, be wary and do not click!
Some of the more intelligent browsers may be able to flag the site and warn you to stay away, but this may not always be the case.

Where else to look?
One of the first places I checked was whether I had received any notification from the bank that has provided me the credit card. They will always keep you posted on the purchases made using the instrument, via SMS or email. I hadn’t received any. I then logged into the banking app on my mobile where my card is linked, and checked whether there was any transaction posted there. There wasn’t any.

These data points will confirm that there is no purchase made against your credit card, no credentials are compromised, and therefore there is no reason to panic.

Other Phishing Techniques
The example I have cited above is phishing via email, trying to create a sense of panic.  Scamsters use alternative mechanisms as well. Phishing via phone calls is called vishing, and phishing via SMS messages in called smishing. I will write about these in another blog.
The instances of credentials being compromised because of a technical hack are very rare – it requires a lot of work. But in most cases, you will find that the psychological play on the victim’s mind results in the leak of sensitive information. The main ploy remains the same – create a sense of panic, or lure the victim with the promise of a reward. In both cases, the rational mind is not in control, increasing the chances of a mistake.

Enjoy the convenience, with caution
The two main things to keep in mind:
* Be aware that genuine companies / banks will not ask for your credentials or OTP – whether on phone call, or mail or sms.
* Be aware that there is no free lunch!
So, as described, if any of the checks you do raises a red flag, remember “When in Doubt, Throw it Out! Stay away from the clickbait offered by these phishy fellows, and continue to enjoy the convenience and benefits of digital commerce with confidence.

Title pic credit : Webroot