Fake websites means fake Captchas
Fake websites are sites that look legitimate, but are actually designed to steal your data, install malicious code on your devices, or lock you out of your device entirely until you pay a ransom. These are sometimes copies of websites that users trust; Google, Microsoft or Amazon, for example.
Finding yourself on one of these fake websites can happen in a number of different ways; a phishing email with a dodgy link, a pop up that you haven’t noticed, or accidentally selecting a strange advert on a legitimate webpage. In this scam, this is where the fake captcha will appear.
When Captcha tries to catch you out
Captchas can take many forms; sometimes you’ll be prompted to copy the text in an image into a text box, add some numbers together, or sort some images. However, in this scam, you’re not asked to do any of these things. Instead, a pop up will appear that says ‘Complete these Verification Steps’.
The pop up looks just like the Captcha box you’re used to; it uses the same branding and colouring, and if you don’t read the instructions too closely, it’s easy to follow the instructions automatically. However, these Verification Steps prompt you to follow some steps on your keyboard.
The first is to hit your Windows key and R, which brings up the Run dialog window. This is a window which allows you to run a program or an app. You’re then instructed to hit Control and V, which pastes something into that dialog box (usually, something that the fraudulent website has told you to Copy). From there, you’re prompted to click Finish.
If you follow these steps, it means you’re giving permission for a program to run on your device, which in this case, is likely to be a form of malware. Once the program is running, it's very difficult to know exactly what damage it is doing to your device; it could immediately shut your device down, steal your information to sell on, access your applications, or it could just continue working quietly in the background.
When your device is connected to a network, like the Wi-Fi at your office, or a VPN, accidentally installing malware like this can mean that everything on that network is also at risk. Filling in a fake captcha could mean a big problem for your business.
Don’t fall for the fake captcha
- Know what a real Captcha looks like
Captcha’s function is to check that you’re a legitimate user accessing a website. There is no need for Captcha to run anything on your device. If a pop up prompts you to follow a series of commands like this, it is a fake. Real Captchas will always prompt you to select images, solve a maths problem or write some text. - Avoid phishing emails
Phishing emails are a really effective way of getting you to open up a website that you wouldn’t otherwise visit. If someone has sent you a link in an email, check the link carefully before clicking, verify the source, and where possible access the website directly yourself. - Get educated
Scams are developing and changing all the time, and the biggest security risk is user error. Instead of crossing your fingers, get your staff trained and educated with U-Secure. This learning platform provides employees with short training courses, quizzes and then gives management the results, so you can see who needs a little extra help detecting scams
To give U-Secure a try, call us on 0191 482 0444
