The Ministry of Justice Information and Communications Technology judicial support team provided a phishing and scam emails alert at the beginning of May 2020. It was a timely reminder to us all to protect our online space not only at work but also at home. The team kindly gave JANZ permission to republish their email.
Globally cybercriminals have been using people’s preoccupation with COVID-19 as a weakness that can be exploited. That’s also the case in New Zealand and at the Ministry. We need to be particularly vigilant at the moment.
During COVID, the Ministry has seen an uptick in phishing and scam emails, due to scammers playing on people working differently and having increased anxiety. In the month of March alone, the Ministry blocked 206 emails containing viruses and 47,162 spam emails before they got to you. However, this isn’t just a technology problem and we can’t catch them all, so we need your help to be diligent, and try and catch these scams.
What does it look like?
Scammers can be quite clever and at first glance, a scam email or text may seem to be legitimate correspondence, and may even appear to come from someone you know and trust. These scams can happen over a number of different platforms such as text, phone, or email and may be targeted at you or may target a wide range of staff.
Some things you can look out for include:
Contact that is out of the blue: who’s trying to contact you? Even if the person says they’re from a legitimate organisation like the bank, your internet provider, or even from the Ministry of Justice, they may not be who they say they are. Check their email address, and make sure they’re who you think they are.
Needing to verify your account or details: don’t respond or click on any links in the communication even if it looks like it’s from a real organisation. Go to the website directly.
Being asked for passwords: legitimate organisations will never ask for the passwords to your online accounts.
Unusual ways to pay for something: scammers try to use payments that can’t be traced such as pre-loaded debit cards, gift cards, bitcoin, iTunes cards, or money transfer systems.
Pressuring you to make a decision quickly: this could be to avoid something bad (e.g. account being closed, trouble with the IRD) or to take advantage of something good (a deal or investment).
Asking for remote access to your device: never do this unless you have actively sought out the service they’re providing. The Ministry has trusted ways to access your work device.
Trying to get you to move outside of an online trading or booking website or app (like Air BnB): don’t pay outside of the normal website or app processes.
Offering money or a prize in exchange for something upfront: they might say that it’s a processing fee or something similar.
Being asked for money by friends/partners you’ve met online: this is a very common tactic, do not pay the money.
Getting told there’s a problem with your phone, laptop, or internet connections: often scammers will offer to fix your device or say they are from your phone or internet company.
What should I do?
If you think that you’ve been sent something suspicious, or even if you’re just unsure, forward the email as an attachment to ictsecurity@justice.govt.nz.
Further information regarding phishing can be found here and information regarding social engineering here on JET. CERT NZ (Computer Emergency Response Team) also have a lot of great information regarding phishing here, and Netsafe provides some great information here.
If you have any questions, please free to also contact the ICT Judicial Support team.