A recent trend that has been growing in popularity is the use of phish emails targeting various bank brands. In fact, phish emails are becoming so popular that several major banks, such as Capital One, JPMorgan, and Citibank, have stepped up their efforts to combat phishing attacks. By using phish emails, the banks are hoping to get their brand names out there, and protect their users’ personal information. This is especially true as banks are launching more sophisticated authentication processes, as well as other security measures. Learn more about the Capital One phishing attack.
Authentify
Capital One is a digital-only bank, which means that its customers do not use physical locations to conduct their banking transactions. But that doesn’t mean that the bank has not been subject to phishing attacks.
Recently, Authentify, an online verification service, announced a collaboration with Capital One. As a result, phishers have been attempting to capitalize on this partnership and the Capital One name to launch a phishing campaign.
Authentify’s online authentication tool allows users to perform online transactions with their credit card or banking accounts without having to type in usernames and passwords. In addition, the company has collaborated with PNC Financial Services Group Inc. and Truist Financial Corp. as well as Bank of America Corp. and Wells Fargo.
The Capital One phish is design to make the customer think that he or she is signing up for the Authentify service by providing the user with a legitimate looking email. However, the email link redirects to a compromised WordPress website that impersonates the financial institution. Users asked to upload photo IDs, such as a state-issued ID. If they don’t, the attackers will restrict their account.
While the phishing campaign leveraging the Authentify and Capital One partnership isn’t the first, it is the first to hit large numbers of consumers. This is thanks in part to a lack of social media monitoring by the company. And the fact that the Capital One email sent from an Indian IP address.
The Capital One phish was a small example of the many phishing campaigns leveraging popular brand names to lure unsuspecting victims. Researchers at Vade warn consumers to be wary of emails from financial institutions. They also point out that phishers are likely to take advantage of news items and other technological advancements to promote their scams.
Overall, the Capital One phish is one of many examples of how phishers are taking advantage of the latest partnerships between financial institutions and digital challengers. To protect yourself from these scams, be careful of emails from financial institutions, don’t click on links in them, and keep up with the latest headlines.
Capital One
If you have a Capital One account, chances are you have bombarded by an email claiming to be from the bank with an unproven claim that you can use your photo ID as a password. However, there are some red flags to watch out for.
First, the link is not a legitimate URL. Instead, it redirects to a hacked WordPress site. The resulting webpage is nothing but a fake Capital One account page. This is not the first time Capital One has been a target of phishing attempts.
The email itself looks like it came from a legit Capital One email account. However, it sent to an Indian IP address. It also omitted a couple of notable gimmicks: the display name and the cryptic URL.
Authentify is an online verification service that is gaining traction with many banks, including Capital One. They have teamed up with six other institutions to improve user experience. In the name of security, they require users to provide a front and back of a state-issued ID before they can access their accounts. A phishing campaign is taking advantage of this opportunity to steal your identity.
Authentify has also been a partner with several other household names. Other banks and financial institutions that have made similar partnerships include Bank of America, PNC, Truist, and U.S. Bank. With the help of these partners, a phish worthy website can create that will lure the gullible into handing over their personal information.
Authentify is the first of its kind, but it has replicated in other forms. As such, the company expects its partnership with Capital One to be the start of a new trend in targeting financial organizations. Fortunately, Capital One was able to respond in a timely fashion, ensuring that its customers protected and that no data lost. After discovering the hack, the bank was able to quickly remediate the problem. Having said that, the company should have been aware of this attack.
JPMorgan
A recent collaboration between Capital One and Authentify piqued interest in phishing campaigns. These spoofed Web pages requested sensitive online banking details. The campaign reached 6,000 e-mails in one day. As a result, hackers have exploited the brand in multiple ways.
Capital One offers a 5% cash back reward on e-commerce purchases. They also offer co-brand credit cards for retailers. Walmart and Williams Sonoma are two of the brands they have partnered with. Their co-brand programs have proved very popular.
To stay ahead of phishing attacks, banks and financial institutions are seeking to create partnerships with digital challengers. Many of these digitally native organizations are seeking to take the reins of customer acquisition from the more traditional banking institutions.
While some financial institutions are seeking to capitalize on new technologies and partnerships, others are making a move to build their own technology platform to provide financial services. Several major brands have made moves in this direction, including JPMorgan Chase, which is moving into travel.
Capital One has also started to experiment with new product lines. It has recently announced plans to launch a full-service travel business. This can be a valuable strategy for the bank as they try to diversify their portfolio. With a full-service travel business, Capital One can offer its customers travel services like airport lounges.
As more companies move into the travel industry, they will need to work with issuers that have an affinity for travel. Some retailers may look to partner with issuers that boost spending. Whether or not the deal works, the bank can benefit from its partnership with a digitally native brand.
However, the risk of targeted phishing is still a concern for consumers. Whenever a financial institution sends out an email, it’s best to double check to make sure it’s genuine.
Fortunately, the Capital One breach easily remediated once the hacker caught. This is a good example for other organizations to follow. Although Capital One stumbled in their attack, they learned from the experience and have responded quickly.
Other banks
A new phishing campaign is use to exploit Capital One’s recent collaboration with Authentify, a security firm that enables banks to verify customer identities. The campaign began in July and has reached 6,000 emails in a single day. It is threatening to limit the access to accounts if users don’t provide an ID.
In the e-mail sent to the user, the Capital One corporate email address appears legitimate. However, the link in the message redirects to a compromised WordPress website. Users asked to upload the front and back end of a state-issued ID. Once users do this, the phishers can steal their identities. This is a typical strategy for phishing campaigns, and other financial institutions have been a target of similar targeted phishing attacks.
Vade
According to researchers from Vade, consumers should be cautious of third-party applications affiliated with financial institutions. Many of these phishing schemes attempt to co-opt well-known financial services brands like Capital One, Wells Fargo, and Bank of America. As a result, consumers should never log in to their online accounts from an email. Instead, they should always log in directly from their browser.
In addition to the Capital One phishing campaign, several other financial firms have collaborated with Authentify, including PNC Bank, Bank of America, U.S. Bank, and Truist Financial Corp. Those partnerships have also led to targeted phishing campaigns against consumers. Authentify recently announced a deal with six other banks. These include Wells Fargo, Bank of America, Truist, and PNC.
To avoid becoming a victim of a phishing campaign, consumers should make sure they never open emails from financial institutions. Also, they should be wary of emails that request sensitive information or require an account password. If a user receives an e-mail asking for such information, the victim should contact the bank to check the legitimacy of the e-mail. While phishers are constantly trying to develop ways to evade detection, consumers can protect themselves from phishing attacks by being aware of these warning signs.
Recommended readings:
