Cybercrime …E-mail hacking
– The enemy may be hiding in you e-mail
South African Banking Risk Information Centre (Sabric)
issued a warning to banking customers about e-mail
hacking and other related cybercrimes on 7 April 2014.
This follows numerous reported incidents in which
banking customers’ e-mail accounts were hacked and
hackers attempted to give instructions to banks while
impersonating the banking customers.
What is e-mail hacking?
According to Kalyani Pillay, Sabric’s CEO, e-mail hacking
is a criminal act where criminals illegally access an e-mail
account and communicate as if they are the user. The
cybercrime safety and security guide (http://cybercrime.
org.za) states that hacking means trying to get
into computer systems in order to steal, corrupt or illegitimately
view data. The term "hacking" comes from
the term "hacker", which is someone who enjoys, and is
an expert in, computer programming languages and
systems. Hacking, in this sense, means using unusually
complex and clever methods to make computers do
The reason why people would want to hack into your
e-mail is to steal account holders’ usernames and
passwords through phishing or other means,and to trick
users into disclosing their details. They then utilise the
compromised information to access and use the user’s
Apply extra caution when you use
a free e-mail address
Judging by reports that Sabric has received, it is clear
that the most frequently targeted e-mail services are
those that are free (eg gmail, hotmail, or yahoo), as
they do not require any special configuration or usage
consent. If you are a bank customer using one of these
free e-mail addresses, you need to take extra precautions
to tighten your online security. If you receive
e-mails purporting to be from e-mail service
providers, such as Yahoo or Google, with content similar
to the bullets below, you need to be on your
h8708; Your e-mail is full and you must use the link provided
to delete messages or increase your mailbox
h8708; Important and for immediate attention: Please log
in using the link provided.
I prefer using e-mail for
correspondence. This is
not only because it is
(generally) fast and efficient,
but also because
it allows me to keep a
record of a conversation;
instruction. This simple
advantage has come
in handy many times in
the past – both in my
professional and personal
life. However, the
reality is that criminals
are targeting this form
of communication and
thousands of people
are falling victim to it.
Criminal value chain
May 2014 ervamus 43
h8708; We are experiencing congestion
due to anonymous registration
of accounts and are
closing some e-mail accounts.
Please verify that you would
like to retain the e-mail
account by logging on through
the link provided.
Do not react emotionally – think
and verify the content before reacting.
Criminals love using tactics whereby
they pose as a respectable and
legitimate organisation, such as
SARS, during which they ask you
(the user) to log onto your e-mail
account through the provided links
to access your online tax information.
Once you have clicked on the
hyperlink, you will be requested to
provide your username and password,
which will then be routed to
the criminals and used by them to
sign onto your account pretending
to be you.
Beware: There is an increase in
these types of e-mail messages
around the time when people start
to file their tax returns, as that is the
time when one expects correspondence
from SARS.Remember, SARS
and various banks need to interact
with you in person to verify your
banking and personal details. SARS,
especially, is not allowed to do this
telephonically or via e-mail.
How do I know my email
There are a number of signs or
clues that your e-mail account may
have been hacked, including:
h8708; Complaints about spam being
sent from your e-mail address;
h8708; receiving large numbers of
undeliverable or bounced messages
which you did not send;
h8708; unknown e-mails appearing in
your Sent Items folder.
What can I do to prevent e-mail
It is human nature to keep our passwords and our PINs
simple and similar. Criminals love predictability and it is
therefore highly advisable to guard your online identity
carefully by constantly changing and devising complex
passwords that cannot easily be guessed, such as your
birthday date, you pet’s name, a nickname or a family
members’ name. Follow these tips:
h8708; We often fall into this trap, but it’s advisable never
to list your main e-mail addresses publicly, anywhere.
This includes online advertisements, blogs or
any other place where it can be harvested by spammers.
h8708; Do not divulge your life and your personal details
on social media – criminals use a variety of ways to
obtain this information. Also ensure that your settings
on your Facebook profile are set so that only
your real friends can see your personal details and
posts. Also, be careful of who you befriend via social
h8708; Use a separate e-mail address for the Internet
which is not linked to your personal or business
h8708; Make sure that your PC, laptop or smartphone is
updated with the latest OS updates and antivirus/
h8708; Never Google your bank’s website address – type
the whole address from scratch, ie www.absa.co.za
h8708; Check to make sure that you are on the real site
before using any personal information.
h8708; If you think that you might have compromised yourself,
contact your bank immediately.
h8708; If you use an account manager who manages your
bank account on your behalf, make sure that you
have a secondary approval system in place, such as
that all instructions are verified via a phone call
(rather than using e-mail instructions).
h8708; Read and think before you react to an e-mail message.
For example, when you receive an e-mail from
a bank where you do not hold an account, ask yourself:
Why would you want to react to a message
about a so-called deposit which you have to confirm
to receive into your account (which you don’t
have)? Or, if you hold more than one e-mail address
and you receive an e-mail at the e-mail address
which is not linked to your Facebook account, why
would you react to that message? Don’t fall into this
h8708; Log into your e-mail on a secure PC and then check
whether or not any of the settings have been
changed by a hacker. If any of the settings have been
altered, delete the new settings.
h8708; Once you have changed the settings, create a new
password and add your secondary e-mail account as
your alternative address.
h8708; Don’t use public computers to check e-mails;
there’s virtually no way to know if they have been
accidentally infected with malware, or someone has
intentionally installed key-logging spyware.
h8708; Do not leave sensitive documents such as bank
statements in your Inbox. Rather save them elsewhere
and delete the original mail with all annexures.
h8708; Do not give logical answers to security questions,
which someone may be able to guess.
h8708; Ensure that you have a very good relationship with
your bank so that the bank will be able to identify
and confirm any unusual requests purporting to
come from you.
h8708; Do not use software that purports to be able to
hack e-mails as this software may itself contain malware
that will compromise you.
h8708; Monitor your bank accounts to check that no irregular
activity has taken place without your consent
h8708; Register for SMS notifications so that you are notified
of any transaction on your bank account.
h8708; If you use a public webmail, such as yahoo or gmail,
please ensure that you enable a two-factor password
system where an OTP (one time password) is
sent to your cellphone before you can access your
Report these messages
It is important that we report phishing messages to our
service providers before deleting them.
Absa : Fraud hotline: 0860 557 557
: 3D secure call centre:(011) 354 4058
Capitec : 0860 10 20 34
Facebook : firstname.lastname@example.org
FNB : email@example.com
Nedbank : 0860 115 060
Paypal : firstname.lastname@example.org
SARS : email@example.com
Standard Bank : firstname.lastname@example.org
* * *
During the media briefing, Kalyani Pillay, Sabric’s CEO,
concluded with the following message: "Your cyber
interactions should be layered. Leaving your online banking
system open is like sleeping with your front door
open. Opening an e-mail from unknown sources is like
letting a stranger into your house