Scam Words Crooks Use to Trick You

Security firm lists top cybercrime scam words: Internet Scambusters #551

Cyber crooks have their own dictionary of scam words.

They know that certain terms are more likely to get you to
click on links and attachments that lead to trouble.

In this week’s issue we explain how they use shipping-related
words for one set of scams, as well as some other terms to be
on the lookout for.

Before we begin, you may want to spend a moment looking at
this week’s most popular articles from our other sites:

Evernote Launches Reminders – Its Biggest Missing Feature: If you use Evernote as your To Do list, it just became a LOT more useful with the introduction of Reminders.

Russian Chocolate Butter: Necessity is the mother of invention… and when Soviets craved their chocolate, they had to make it stretch with this solution.

How to Budget for a New Year: Although it takes some time and effort to learn how to budget your money, this process itself is not that difficult.

The Allure of Grilled Crustaceans: Here are some things to know about grilling crustaceans, whether you’re dealing with crawfish, crabs, lobsters, or any other oceanic insectoids.

Now, here we go…

Scam Words Crooks Use to Trick You

One of the biggest challenges cyber crooks face — not that we
have any sympathy for them! — is coming up with words that’ll
most likely convince you to click on their troublesome links
or attachments.

But there’s a catch. Security software that most of us have on
our PCs is set up to look for suspicious words, so the crooks
need to use words that will evade this first line of defense.

One of the main tricks they use is to create fake shipping
notifications, especially if they’re targeting businesses.

Experience suggests we’re more likely to click on these than
anything else.

More than a quarter of all words featured in malicious emails
monitored by one security firm, FireEye, concerned shipments
or postage.

FireEye actually compiled a league table of those words.

Naturally they include the names of all the big shippers and
mail organizations because, when we see those names, we’re
inclined to trust them.

FireEye’s Top 10 shipping scam words is as follows:

1. dhl
2. notification
3. delivery
4. express
5. (the date year)
6. label
7. shipment
8. ups
9. international
10. parcel

Also in the full charts are words like “alert,” “urgent,”
“confirmation” and “usps.”

Many of these shipping-related messages are used for spear
phishing — emails targeted at specific individuals.

We explained how spear phishing targets executives in an
earlier Scambusters issue, Whaling? These Scammers Target Big Phish.

When the messages have attachments, the most common form —
shown in the letters after the dot in the attachment name —
is “.zip,” a compressed file that is difficult to inspect
without opening it.

This accounts for three quarters of attachments in what
FireEye calls “advanced malicious attacks.” In second place is
“.pdf” — commonly used for documents readable on most PCs
with the right software.

“Cybercriminals continue to evolve and refine their attack
tactics to evade detection and use techniques that work. Spear
phishing emails are on the rise because they work,” says Ashar
Aziz, founder and CEO, FireEye.

After shipping terms, the next most common word category used
by cyber criminals is finance.

They often use the name of a bank, refer to transactions and
have official-looking forms attached. Tax-related words are
also popular, especially when they include “refund”!

Attachments named for things like airline tickets or invoices
are another common feature of spear phishing.

The Internet Crime Complaint Center (IC3) says spear phishing
emails are particularly effective because cybercriminals use
information from social networking sites to personalize emails
and make them look more authentic.

However, there are lots of other giveaways in scammers’ choice
of words that you can be on the lookout for.

As we frequently report, bogus messages from Nigeria or other
countries where English is not the first language often give
themselves away just by the use of wrong words and grammar.

Sometimes, they use quaint words and phrases no longer in use,
seem over-polite or tell you they’re “temporarily out of the
country,” or similar wording.

You can learn more about this whole topic in our scam language
special report, Know the Lingo — How to Get Wise to Scam Language.

On dating sites, crooks also over-use abbreviations, some of
them seemingly obscure even to seasoned surfers, and other
just repeated too often — like “cos.”

More Scam Words Categories

Here are six word categories that suggest you could be on the
receiving end of a scam attempt:

Unlikely words: For example, an email with “business proposal”
or another opportunity-related term as an attachment or
subject heading would almost certainly be a scam.

After all, who initiates a business idea with you in this way?

Out of character: An email purports to come from someone you
know but the words it uses just don’t sound like they’d come
from that person.

Claims of secrecy: Messages that claim to be “confidential,”
“for your eyes only” or based on “inside information,”
especially from someone you don’t know, should arouse your

If it’s from someone you don’t know, it’s a scam. Who in their
right mind would send a genuinely confidential item this way?

If it’s from someone you do know, be really wary. Contact them
first, if you can, to check that they sent it.

Promises of wealth: As in the aforementioned Nigerian scams.
But let’s not forget lottery wins (e.g., “claim,” “prize,”
“awards office”) and investment emails that use words like
“guaranteed,” “opportunity,” “risk-free” and “fortune.”

If it’s not a scam, it’s at least likely to be spam.

Sensation: Words like “shock,” “sensation” and personalized
phrases like “you gotta see this” or even “is this you?” are
designed to make you want to click a link or an attachment.

Never do that without checking the source.

It’s easy: Be cautious of words that suggest something you had
imagined would be quite tough, is easy.

For job hunters, “no experience necessary” should be a red
flag. So should things like “I earned $xxx in just xx hours”
— you fill in the amount and time — but we guarantee they’ll
be amazing.

Similarly, money plans that offer “instant loans” may turn out
to be too good to be true.

So now that you have “inside information” on the scammers’
dictionary, you should have a better idea of what to be on the
lookout for.

Few of us might claim to be true students of language, but
paying attention to scam words could at least give you a
degree of security.

That’s it for today — we hope you enjoy your week!