Kaspersky has unearthed a major scam involving the GOV.UK website that has the ability to steal huge amounts of personal information.
The scam is known to have been active since November 2023, and is targeting individuals looking to claim Cost of Living payments and those filing tax returns over the holiday period.
The GOV.UK site is used by millions of people every year for services and information, and often requires the provision of email addresses, home addresses, contact information and financial information for some services.
Holiday horror
The holiday season is one of the most popular times for individuals to file tax returns, indicating that this scam was designed to target the peak in usage of the GOV.UK site. In the 2021-2022 tax year, over 22,000 tax forms were submitted to the site during the Christmas period, and given how some may be feeling the monetary strain during this time, it is also expected that there are a significant number of individuals seeking additional assistance.
"This campaign is as dangerous as it is unique, focusing on a range of targets who are reliant on Government support, from small to medium sized businesses through to the most vulnerable in our society,” said David Emm, Principal Security Researcher, Kaspersky.
“The level of detail and scale of services being mimicked means that there are numerous ways this scam is catching people off guard. Phishing normally targets lots of individuals for relatively small amounts of information or money, but this is a very carefully crafted campaign that requires an extremely high degree of caution on the part of the recipient.”
Kaspersky has recommended that organizations do not include hyperlinks in their marketing campaigns, and instead display their full legitimate URL so that individuals can fully verify the legitimacy of the website before clicking the link.
"NotGOV shows that criminals are learning from their mistakes and now capable of creating highly accurate imitations of legitimate email communications to defraud people of their personal information,” Emm concluded.
“To remain safe, we must move beyond simply relying on spotting mistakes in text or images. Instead, there needs to be a root and branch review of the regulations around official communication methods and channels, but also a total reshaping of people’s behaviour.
"Simply put, if you receive any sort of message encouraging you to click, don't. Manually search for the information and navigate your own way around a website. It may take longer, but it will keep you safe."
