Canada Imperial Bank of Commerce, Favorite Whipping Boy of Phishers
Phishing attacks anchor itself by its two strong instruments:
- Pretending to be from a popular brand
- The clever presentation making its message believable
Without these two aspects, phishing attempts will be no better than the regular “viagra” spam emails that are filling-up the mailbox of billions of email users globally. The best example of phishers gravely using the two aspects of successful phishing attacks is the recently discovered massive phishing attempts using the Canadian Imperial Bank of Commerce brand.
CIBC’s brand has been used by phishers for their phishing activities the most for the 3rd quarter of 2018. An increase of 622% compared to the 2nd quarter of 2018, tricking some bank clients to fall for the scam as the CIBC is one of the most trusted banks in Canada. The bank has made banking easier starting last year with their Simplii Financial project, that enables interaction and banking transaction less complicated to new and existing clients.
CIBC itself created a special microsite, containing samples of the most common phishing emails that they have collected from customers reports. Three samples they provided are presented below:
From: [Email Address]
Subject: Online Access Locked
To: [Email address],
As a result of some technical issues detected CIBC has locked access to your account as we noticed an invalid sign-in attempt to your online account during our security update routine. You should recover your account by clicking the link below.
Click here to regain access [Link Removed]
You will regain full access to your online account after verifying your account information with us. Help us at CIBC to ensure the safety and security of your account at all times.
CIBC Online Security Team.
This email was sent from a notification-only address that does not accept email replies. Please do not reply directly to this email.
From: CIBC Canada [Email Address]
Secure your online account now.
We are writing to inform you of an issue that affected your account. We noticed some discrepancy in the information we have on file for you. As a result of the incorrect or incomplete information, we have limited your account. Confirm your personal information to enable unlimited access to all online banking features.
We appreciate your business and look forward to the opportunity to continue serving your banking needs.
Confirm Account [Link Removed]
Protecting your privacy is our top priority.
This email was sent for the ongoing support and maintenance of your account. To manage your communication preferences, please visit our preference centre.
From: INTERAC e-TRANSFER [Email address]
Subject: INTERAC E-TRANSFER | Payment Received | Paiement Reçu | xxxxxxxxxxxxxxxxxx
Hello [Email Address]
This message may contain privileged and confidential information.
It is intended solely for the person to whom it is addressed.
THIS IS AN AUTOMATED EMAIL – PLEASE DO NOT
REPLY AS EMAILS RECEIVED AT THIS ADDRESS
CANNOT BE RESPONDED TO.
A refund has been issued by INTERAC Canada.
Amount: $244.90 (CAD)
Sender’s Message: A message was not provided
To deposit your money, click here: [Link Removed]
“Cyber security is an evolving space that we monitor closely. We have multiple layers of security in place and continuously invest to safeguard our clients. Organizations that have a global footprint are going to be targeted more often and probably more frequently over time,” explained CIBC.
The banks frequently remind their customers that they will never ask for personally identifiable information through email, SMS or instant messaging. People should be made known that no real bank will ask for that information, as they already have the customer’s contact information and financial records, there is no need for them to ask them again from clients.
Julia Sowells700 Posts
Julia Sowells has been a technology and security professional. For a decade of experience in technology, she has worked on dozens of large-scale enterprise security projects, and even writing technical articles and has worked as a technical editor for Rural Press Magazine. She now lives and works in New York, where she maintains her own consulting firm with her role as security consultant while continuing to write for Hacker Combat in her limited spare time.