The Australian Tax Office (ATO) have issued a warning about a new phishing scam doing the rounds.
Unsuspecting marks receive an email informing them that they are eligible for a refund on their paid up taxes.
The bogus mail contains a link to a very convincing looking phishing web site (see screen shot below) designed to harvest personal and credit card details enough to commit card-not-present fraud or to create an inventory of “fullz” (personal details such as name, address, postcode, etc.) and credit card details for sale on the underground economy.
These particular criminals though left the front door of their phishing site more than a little ajar, giving us a glimpse into the numbers of victims affected by this particular scam. You can see from the site statistics below that the site has counted over 200,000 hits in the four months to June, with the majority of those occurring over these first 18 days of June.
Aside from the advice to never surrender personal and financial details in response to unsolicited email, and always to check the URL in the address bar before entering any sensitive information, there is another important point to be made.
The URL to this scam site has been forwarded and shared around online, in a kind of “Wow, look how convincing this scam is” sense, this will be one thing that has contributed to the high hit rate this month.
This is never a good idea and I would urge all of you not to do this, (see, there are reasons why security bloggers tend to partially obscure URLs). It is not uncommon for sites such as this to serve a dual purpose and aside from phishing for information, they could well have been designed to attempt to invisibly infect visitors with data stealing malware. Thankfully in this instance that does not appear to have been the case.