#DOCUSIGN CHANGING DOCUMENT INFO SCAM PDF#

You ought to notice that the URL seems unlikely for a major bank, given that it’s a DNS redirector service in the Philippines, and that the site it redirects to is even more unlikely, given that it’s a hacked agricultural company in Bulgaria.īut one thing is certain, namely that the visuals are surprisingly close to the bank’s regular login page: …so it doesn’t feel like the you-know-it’s-risky option of “clicking links in emails” any more.

#DOCUSIGN CHANGING DOCUMENT INFO SCAM PDF#

So you might be inclined to open the attached PDF, which is indeed just a replica of the document in the Docusign window:Įxcept that the link in the PDF version of the document is live, and if you’re still wondering what’s going on, you might be inclined to click it, given that the PDF probably opened in your chosen PDF viewer (e.g. “Is this some kind of imposter?”, you are probably wondering, “And what on earth are they talking about given that Docusign only has a page for me to view, not an actual contract to process?” It’s not a contract, so there’s nothing to identify the person at the other end, or to reveal what the document is about, so the Docusign link is actually a red herring, though it does add a sense of legitimacy-mixed-with-curiosity into the scam. The Docusign page itself isn’t dangerous because it doesn’t contain any clickable links, and just seeing the curious text in it should make you realise that this is just what it seems, a suspicious and unlikely document about nothing: (We have labelled the Docusign screenshot below as FAKE because the content is made up, in the same way we label emails FAKE even if they appear in your trusted email app.) The email itself comes from cloud-based document and contract-signing service Docusign, and includes a link to a genuine Docusign page. This scam starts, like many phishing scams, with an email: These factors include: Do you have an account with the company concerned? Have you done a transaction recently? Are you in the middle of some sort of contract negotiations right now? Did you have a late night? Is your train due in two minutes? Are you thinking clearly today?Īfter all, the crooks aren’t aiming to fool all of us all the time, just a few of us some of the time. The ultimate believability of phishing scams like this one actually depends on many factors. and yet it was still worth their while to spam it out.

On the other hand, the crooks knew all along that 999 people in every 1000 who received this email would know at once that it was bogus and delete it without a second thought… Then, you might wonder to yourself, perhaps with just a touch of smugness, “If 99.9% of them are utterly trivial to detect, how hard can the other 0.1% be?” It’s tempting, from there, to extrapolate that 99.9% of all phishing emails will give themselves away immediately. Let’s do some power-of-ten approximations to show what we mean.Īssume the population of South Africa is 100 million – it’s short of that, but we are just doing order-of-magnitude estimations here.Īssume there are 10 billion people in the world, so that South Africans make up about 1% of the people on the planet.Īnd assume that 10% of South Africans bank with this particular bank and use its website for their online transactions.Īt a quick guess, we can therefore say that this phish was believable to at most 1-in-1000 (10% of 1%) of everyone on earth. So, this was obviously a widely-spammed out global phishing campaign, with the cybercriminals using quantity instead of quality to “target” their victims. There’s no possible reason for any crook to associate Sophos Naked Security with that bank, let alone with an account in South Africa.

(We won’t say which bank by name, as a way of reminding you that it could have been any brand that was targeted, but you will recognise the bank’s own website background image if you are a customer yourself.) Cybersecurity Awareness Month: Fight the phish!įor example, we received a phish this morning that specifically targeted one of the main South African banks.

Docusign changing document info scam