By Erich Kron, CISO Advisor, KnowBe4:
“This is a classic case of borrowed trust, where criminals leverage familiar brands to seem authentic. In this case, using the tax repayment as a lure to build anxiety around the money owed and to get the victim to rush to click and login.
Whichever brand is being leveraged, the technique works in the same way, urgency, authority, and a workflow which seems plausible enough.
Some key takeaways people should remember are that they should treat any message which drives you to log in via a link as suspicious. Also, be mindful of new processes being introduced. If an organisation suddenly changes how it manages refunds, it’s a red flag. Also, be mindful of how the communication makes you feel. If it invokes a strong emotion or tries to get you to react immediately, then it’s a good time to pause and verify. Finally, enable MFA for accounts where available and use strong unique passwords for different accounts.”
