Scam Words Crooks Use to Trick You

One of the biggest challenges cyber crooks face -- not that we have any sympathy for them! -- is coming up with words that'll most likely convince you to click on their troublesome links or attachments. But there's a catch. Security software that most of us have on our PCs is set up to look for suspicious words, so the crooks need to use words that will evade this first line of defense.

One of the main tricks they use is to create fake shipping notifications, especially if they're targeting businesses.  Experience suggests we're more likely to click on these than anything else.  More than a quarter of all words featured in malicious emails monitored by one security firm, FireEye, concerned shipments or postage.  FireEye actually compiled a table of those words;  they include the names of all the big shippers and mail organizations because, when we see those names, we're inclined to trust them. FireEye's Top 10 shipping scam words is as follows:

1. dhl

2. notification

3. delivery

4. express

5. (the date year)

6. label

7. shipment

8. ups

9. international

10. parcel

Also in the full charts are words like "alert," "urgent," "confirmation" and "usps."  Many of these shipping-related messages are used for spear phishing -- emails targeted at specific individuals.

When the messages have attachments, the most common form -- shown in the letters after the dot in the attachment name -- is ".zip," a compressed file that is difficult to inspect without opening it.  This accounts for three quarters of attachments in what FireEye calls "advanced malicious attacks." In second place is ".pdf" -- commonly used for documents readable on most PCs with the right software.

"Cybercriminals continue to evolve and refine their attack tactics to evade detection and use techniques that work. Spear phishing emails are on the rise because they work," says Ashar Aziz, founder and CEO, FireEye.

After shipping terms, the next most common word category used by cyber criminals is finance.  They often use the name of a bank, refer to transactions and have official-looking forms attached. Tax-related words are also popular, especially when they include "refund"!

Attachments named for things like airline tickets or invoices are another common feature of spear phishing.  The Internet Crime Complaint Center (IC3) says spear phishing emails are particularly effective because cybercriminals use information from social networking sites to personalize emails and make them look more authentic.  However, there are lots of other giveaways in scammers' choice of words that you can be on the lookout for.

As frequently reported, bogus messages from Nigeria or other countries where English is not the first language often give themselves away just by the use of wrong words and grammar.

Sometimes, they use quaint words and phrases no longer in use, seem over-polite or tell you they're "temporarily out of the country," or similar wording.  On dating sites, crooks also over-use abbreviations, some of them seemingly obscure even to seasoned surfers, and other just repeated too often -- like "cos."

More Scam Words Categories

Here are six word categories that suggest you could be on the receiving end of a scam attempt: Unlikely words: For example, an email with "business proposal" or another opportunity-related term as an attachment or subject heading would almost certainly be a scam.  After all, who initiates a business idea with you in this way?

Out of character: An email purports to come from someone you know but the words it uses just don't sound like they'd come from that person.  Claims of secrecy: Messages that claim to be "confidential," "for your eyes only" or based on "inside information," especially from someone you don't know, should arouse your suspicions.

If it's from someone you don't know, it's a scam. Who in their right mind would send a genuinely confidential item this way?  If it's from someone you do know, be really wary. Contact them first, if you can, to check that they sent it.

Promises of wealth: As in the aforementioned Nigerian scams. But let's not forget lottery wins (e.g., "claim," "prize," "awards office") and investment emails that use words like "guaranteed," "opportunity," "risk-free" and "fortune."

If it's not a scam, it's at least likely to be spam.

Sensation: Words like "shock," "sensation" and personalized phrases like "you gotta see this" or even "is this you?" are designed to make you want to click a link or an attachment.

Never do that without checking the source.  It's easy: Be cautious of words that suggest something you had imagined would be quite tough, is easy.

For job hunters, "no experience necessary" should be a red flag. So should things like "I earned $xxx in just xx hours" -- you fill in the amount and time -- but we guarantee they'll be amazing.

Similarly, money plans that offer "instant loans" may turn out to be too good to be true.

So now that you have "inside information" on the scammers' dictionary, you should have a better idea of what to be on the lookout for.

Few of us might claim to be true students of language, but paying attention to scam words could at least give you a degree of security.

 Source: scambusters.com #551, 7/1/13