Phishing

Phishing is an attempt to obtain personal details from the attack victim by sending a link (through email or SMS) that connects to a fictitious website where the customer is asked to enter his or her personal details.

• In many cases, phishing attempts are aimed at banking system customers with the goal of stealing money from their accounts.
• In the first stage, the attacker attempts to steal the customer’s identification details, which he then uses to enter the customer’s account through the bank’s website or through payment company websites. The attacker usually also attempts to steal additional personal details such as the customer’s credit card details.
• The customer is asked to click on a link or open an attachment.
• The link brings the customer to a page that visually mimics the company’s or bank’s page, where the customer is asked to provide the details: identification and PIN code to the bank’s website, account number, customer password for a company, ID number, individual name and surname, physical address, date of birth, mother’s maiden name, phone number, credit card number, credit card expiry date, and CCV number.
• Using these details, the attacker attempts to transfer money from the customer’s account to another customer from which the attacker can withdraw the money and/or use it in transactions.
• The attacker’s mode of operation includes sending an email in English or Hebrew to a very large number of private individuals, in the hope that a few of them will think that this is a legitimate email from a legitimate company and will therefore provide the details that will enable the attacker to conduct the fraud.
• For instance, the email “explains” to the customer that for his benefit, he should insert the personal details requested, since there is a concern that a foreign entity has made use of his credit card.

• Customers should be more alert, particularly when receiving email or SMS messages where they are asked to key in a means of identification, account details, or credit card numbers.
• Do not in any case provide means of identification or other personal details, even if the reasons seem convincing (such as the need to update customer details in a system to improve service, upgrading of security measures for the customer’s benefit, and so forth). Banks and other companies will never ask to receive such details by email. Requests to update details are made only after a customer identification process, such as through the bank or company’s website.
• Make sure that you are acquainted with the sender’s address (for instance, if you have a membership with it), and check that the address is correct (for instance that it is spelled properly and does not have even a minor error such as writing “peypal” instead of “paypal”).
• Check the content of the message. Is it general (for instance, a message beginning with “Dear customer” without  including customer details should raise suspicions) and is it in Hebrew if it comes from the Bank of Israel or a domestic company?  Is the language proper and correct, without spelling or composition errors)?

Email written in inarticulate, nonstandard, or incorrect language, or that uses terms that differ from the way in which the company or the service commonly corresponds with the customer, should be considered suspicious.

• You should check the link’s address as much as possible, make sure that it is recognizable and that it is written properly. If you receive the link by email, you can also check the link by placing the mouse over it and reading the target address.
• Pay special attention to “smishing” attempts—SMS and WhatsApp messages received on your cellphone with a link to websites—seemingly received from banks or credit card companies.
• We recommend that you install protection software on your personal computers and mobile phones, and that you keep your operating systems up to date.
• If you have any doubt, there is no doubt. It is best not to respond to any message or click on any link before checking it with the bank or relevant company.