ASIC warns of spoof email campaign

The Australian Securities and Investments Commission (ASIC) has warned users of its registry service to be vigilant of scam emails claiming to be from the commission in the wake of two large influxes in recent weeks.

ASIC said fake emails are circulating containing attachments or links to fake invoices containing malware. The fake emails appear similar to genuine ASIC emails.

No legitimate ASIC email will ask users to make a payment over the phone, make a payment to receive a refund, ask for credit card or bank details directly by email or phone, or to download any software, according to ASIC Commissioner John Price.

“It is always important to be wary of unsolicited emails that demand payment or contain suspicious attachments or links, especially if you have never dealt with the organisation they are from,” he said.

Email security company MailGuard said of the two waves of fraudulent emails, one originated from a domain registered in China, while the other was distributed from a domain set up in Cyprus.

Australian businesses are impersonated by cybercriminals daily in scams aimed at stealing money or private information, MailGuard said. The larger an organisation, the more likely they are to be spoofed.

The most common seasonal scams targeting Australia include spoofed Australia Post emails during the lead-up to Christmas, fraud ATO and ASIC emails around tax time and fake energy invoices from companies including AGL, Origin Energy and EnergyAustralia during winter.

Scams popular year-round include fake invoices from telcos including Optus and Telstra, phishing attempts purporting to be from Westpac, ANZ, NAB, Commonwealth Bank and Macquarie Bank, as well as fake messages from popular international online services including PayPal, Dropbox, Google Drive, Apple and Office 365.

Besides the ASIC impersonation campaigns, a wave of fake tax invoices purporting to be from the go via Queensland road toll network are circulating, MailGuard added. The fake invoices include a “download statement” button that hides a malicious JavaScript file.

The domain used in the scam — do_not_reply@goviau.co — was registered in China less than seven hours before fake invoices began landing in inboxes. The real go via domain is http://govianetwork.com.au/.

Follow us on Twitter and Facebook