Coronavirus phishing scams are rising, says Karl Hanmore, acting head of the Australian Cyber Security Centre

In an interview with ABC Radio, Karl Hanmore, acting head of the Australian Cyber Security Centre, warned that cyber criminals are exploiting fears surrounding the COVID-19 outbreak in a new series of phishing scams.

He said companies are self-reporting an average of 145 cybercrime incidents a day and that self-reported losses are just under $1m.

“We’re seeing some upticks now in the COVID space and it’s still the same, most likely the same cyber criminals just trying to go about their normal day job of stealing from us all, and instead of perhaps being something today with a topical media story, they are now all coalescing behind COVID-19 as the one thing they know we’re all interested in right now,” said Hanmore.

Some phishing scams are being distributed via SMS messaging. “You get a message like, ‘You’ve received a new message regarding COVID-19 safety line and how to get tested in your region. Visit…’, and then they will provide a link to a website,” he explained.

“Now if you click on that link, your phone will redirect to that website and the bad guys will download what we call malware, or a computer virus, onto your phone. In this particular scam that’s all about that virus will steal your banking credentials, so the next time you log into your bank, they will try to make off with all your money.”

Scam emails purporting to come from government sources are also targeting businesses and individuals. “The other scam, which is an old one, but I’m expecting we’ll see it rear its head again, is people offering to fix your computer, maybe they will offer a free upgrade or something because of the coronavirus.”

ACSC has been offering advice on how to best incorporate cyber security into contingency planning. It recommends firms:

  • Review business continuity plans and procedures;
  • Ensure that your systems, including VPNs and firewalls, are up to date with the most recent security patches;
  • Increase your cyber security measures in anticipation of the higher demand on remote access technologies, and test them ahead of time;
  • If you use a remote client desktop, ensure it is secure;
  • Ensure your work devices, such as laptops and mobile phones, are secure;
  • Implement multi-factor authenification for remote access systems and resources (including cloud services);
  • Ensure that you are protected against Denial of Service threats;
  • Ensure that your staff and stakeholders are informed and educated in cyber security practices, such as detecting phishing emails, and
  • Ensure that staff working from home have physical security measures in place. This minimises the risk that information may be accessed, used, modified or removed from the premises without authorisation.

Topics