Canada Imperial Bank of Commerce, Favorite Whipping Boy of Phishers

Phishing attacks anchor itself by its two strong instruments:

• Pretending to be from a popular brand
• The clever presentation making its message believable

Without these two aspects, phishing attempts will be no better than the regular “viagra” spam emails that are filling-up the mailbox of billions of email users globally. The best example of phishers gravely using the two aspects of successful phishing attacks is the recently discovered massive phishing attempts using the Canadian Imperial Bank of Commerce brand.

CIBC’s brand has been used by phishers for their phishing activities the most for the 3rd quarter of 2018. An increase of 622% compared to the 2nd quarter of 2018, tricking some bank clients to fall for the scam as the CIBC is one of the most trusted banks in Canada. The bank has made banking easier starting last year with their Simplii Financial project, that enables interaction and banking transaction less complicated to new and existing clients.

CIBC itself created a special microsite, containing samples of the most common phishing emails that they have collected from customers reports. Three samples they provided are presented below:

1.

From: [Email Address]

Subject: Online Access Locked

To: [Email address],

As a result of some technical issues detected CIBC has locked access to your account as we noticed an invalid sign-in attempt to your online account during our security update routine. You should recover your account by clicking the link below.

Click here to regain access [Link Removed]

You will regain full access to your online account after verifying your account information with us. Help us at CIBC to ensure the safety and security of your account at all times.

CIBC Online Security Team.   

Disclaimer

This email was sent from a notification-only address that does not accept email replies. Please do not reply directly to this email.

2.

From: CIBC Canada [Email Address]

Dear Customer,

Secure your online account now.

We are writing to inform you of an issue that affected your account. We noticed some discrepancy in the information we have on file for you. As a result of the incorrect or incomplete information, we have limited your account. Confirm your personal information to enable unlimited access to all online banking features.

We appreciate your business and look forward to the opportunity to continue serving your banking needs.

Confirm Account  [Link Removed]

Protecting your privacy is our top priority.

Customer Service

This email was sent for the ongoing support and maintenance of your account. To manage your communication preferences, please visit our preference centre.

3.

From: INTERAC e-TRANSFER [Email address]

Subject: INTERAC E-TRANSFER | Payment Received | Paiement Reçu | xxxxxxxxxxxxxxxxxx

Hello [Email Address]

This message may contain privileged and confidential information.

It is intended solely for the person to whom it is addressed.

—————————————————————

THIS IS AN AUTOMATED EMAIL – PLEASE DO NOT

REPLY AS EMAILS RECEIVED AT THIS ADDRESS

CANNOT BE RESPONDED TO.

—————————————————————

A refund has been issued by INTERAC Canada.

Amount: $244.90 (CAD)

Sender’s Message: A message was not provided

Action required:

To deposit your money, click here: [Link Removed]

“Cyber security is an evolving space that we monitor closely. We have multiple layers of security in place and continuously invest to safeguard our clients. Organizations that have a global footprint are going to be targeted more often and probably more frequently over time,” explained CIBC.

The banks frequently remind their customers that they will never ask for personally identifiable information through email, SMS or instant messaging. People should be made known that no real bank will ask for that information, as they already have the customer’s contact information and financial records, there is no need for them to ask them again from clients.