Phishers are impersonating major UK banks on Twitter

Customers of UK banks are being targeted by phishers impersonating the banks’ customer support account on Twitter, Proofpoint warns.

The phishers usually choose a variation on the legitimate accounts’ name and replicate its look, and swoop in when a user puts a question to the legitimate account.

In the example depicted above, the fake account is @BarclaysUKHelp, while the legitimate one is @BarclaysHelpUK.

The phisher manning the fake account replies and directs the user to a phishing site that looks very much like the bank’s own login page. Needless to say, users who enter their online banking credentials into this fake site are effectively handing them over to crooks.

Sometimes the scam doesn’t end there, and victims are asked to enter additional personal and financial information. This info will later be used by scammers to bypass the banks’ security measures and access the victims’ account.

Users are often told to be wary of unsolicited messages. This method of phishing is highly effective because the user is already expecting a response from the bank’s Twitter account, and simply assumes that the received message is from the right one. Of course, phishers do everything in their power not to raise any suspicion.

Proofpont says that the phishers have been using Twitter to impersonate every major UK bank. Similar attacks have previously been leveraged against PayPal users.

According to the company, social media phishing grew more than 100% between Q2 and Q3 of 2016.

Users are advised not to be lulled into complacency by the informal nature of Twitter conversations – messages received through the microblogging platform can be just as dangerous as malicious emails or SMSes.

It’s also good to remember that official accounts often have the blue “checked” mark near their name. If not, perform a short Twitter search to see if some other accounts pop up, and if they do, carefully assess each one and weed out the fakes.