This content was created by Robert Siciliano. This content was uploaded by Robert Siciliano. This is a YouTube video titled "ProtectNow Phishes Dr Oz Employees in Phishing Simulation Training" (created 2020-05-19). It is an on-air segment featuring the show host (SPEAKER A), identity-theft expert Robert Siciliano, and a staff member (Christina) describing a phishing simulation run against the show's team. The excerpt demonstrates a spoofed email and website that solicits personal data (including last 4 of SSN), recounts that a few staff were phished, and provides prevention advice (use two-factor authentication, change compromised passwords, report suspicious activity to the FTC).
Chapters
Alright, you all just filed your taxes and be honest, this is the week to check your mailbox the most, right? Everyone's on high alert waiting for their refunds. But how do you know if that letter in the mail is really from the IRS or your bank? And what about email? Who knows? Alright, next up, identity theft. Robert Siciliano is back. What do we need to know to watch out for to catch a suspicious email coming into our inbox claiming it's the bank?
So you're familiar with phishing Phishing with a PH, right? You know, bad guys are phishing, you know, company officers, employees all day, every day, trying to get access to human resources, to accounting, to wire money out of the account. So what we did was my team phished your team, right?
Yeah, my show team and producers.
Yes. So we found like an event that's taking place that we all know they're paying attention to. So we created an email, right, that looks like this. Like, this is my inbox, or basically your employees' inbox.
So I will— y'all got this.
I will say that they did a pretty good job of reacting. So your team is pretty savvy in regards to scams, which is a really good thing. So they got this email, only a couple of them clicked, and the idea was to, once they logged in, here is the email, this is what it looks like from the Benefits Enrollment Center.
Gift suite, it's presents.
Yeah, exactly. And then here it's asking them to click on to get a free gift. Once they click that gift voucher form, they end up on what's called a spoofed website. Once they click first name, last name, we're asking them for the last 4 of their Social Security number, right? What was good was only a couple of them clicked this part of it. Only a couple of them actually got phished. So in general, what you see is employees everywhere, they're adding all their information here because there's something free.
You ask me the clothing size, it's so legitimate feeling, right? You're obviously gonna ship it to me asking me a size, but the last 4 digits of my answer, you probably have the first 6 digits or 5 digits.
Yeah, and once we get this basic information, We can go online and get your photos from social media. We can get your physical and home address. We can find bank account information, email address information, even passwords. So when you receive an email from anybody, it's always best to, if it's like, if there's any immediacy involved there, if it's getting your heartbeat pumped up, is to pick up the phone and call that entity to find out if it's in fact legit.
Oh my goodness. Well, Christina from our control room was one of the folks here who did click on the email scam. Hi Christina, what was going through your mind as you clicked on there? Did you get the clothes? And now that you know what it really was about, what do you think?
I'm super disappointed now. I, when I got the email, I was so excited because who doesn't love free stuff? I love free stuff. And now I feel completely betrayed. I thought it was totally legit because I never get spammed to my work email. So I clicked on it, I was psyched, I put all my information in, and only to get scammed.
Well, you're one of my smartest team members.
That's—
if they can get you, they can get anybody. So these folks shouldn't feel badly about this. But this is clever. It's clever and diabolical. We actually reached out to the American Bankers Association to provide some insight to help keep individuals safe from scams. They told us a couple important things. First is that change your security settings to enable a second step verification to provide extra protection. That's on a lot of phones now.
It's easy to add.
You can— they want you to modify any compromised passwords right away. Don't reuse those passwords for other accounts. Once you got one password to a credit card, people have access to everything else. And if you do suspect suspicious activity, reach out to the Federal Trade Commission to file a report. They actually keep track of this stuff. We'll be right back.
