Waka Kotahi rego Phishing attack

Forums › IT Pro and developers › Waka Kotahi rego Phishing attack

1 | 2 | 3 | 4

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#2926602 14-Jun-2022 21:39

They seem to be pushed at the same time the on holds for covid come off for the last 2yrs. Because they know a buttload more people will likely fall for it knowing its conveniently close if They do 12mnth

Just like the tax ones come out at the end of NZ known tax return period.

As to the how. One client realised it was targeting users who had left 4+yrs ago. But had a public profile verifying the domain/their email. Bit by bit it started targeting the address book by domain with all sorts of first.last combos.
Could even be as simple as a linkedin scrape.

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#2926605 14-Jun-2022 21:58

Spammers don't care about the age of email addresses they target, often. So historic breach dumps (such as, say, LinkedIn from 2013) gives them a list of email addresses to try, and off they go.

Basically if you've used your email address anywhere vaguely close to a cred dump or breach, it's fair game.

I don't get email warnings when my rego's gonna expire, I get them in the post, makes them pretty easy to verify as the real deal!

See also: Report a Phishing Scam @ NZTA. https://www.nzta.govt.nz/online-services/report-a-phishing-scam/

No signature to see here, move along...

Batman

Mad Scientist
30014 posts

Uber Geek
+1 received by user: 6217

Trusted

Lifetime subscriber

#2926614 14-Jun-2022 22:53

Linux:

Batman:

mine came when my rego was due

what about you guys?

Did it have the rego of your vehicle in the email?

SOrry I can't recall it was a while ago, and the email cannot be found, gmail trash/spam must have cleared it by now

MurrayM

2502 posts

Uber Geek
+1 received by user: 742

ID Verified

Trusted

Lifetime subscriber

#2926640 15-Jun-2022 08:14

BlakJak: I don't get email warnings when my rego's gonna expire, I get them in the post, makes them pretty easy to verify as the real deal!

I didn't even know that you could get email rego reminders, mine always arrive in the post.

eracode

Smpl Mnmlst
9333 posts

Uber Geek
+1 received by user: 6203

ID Verified

Trusted

Lifetime subscriber

#2927925 15-Jun-2022 13:20

amanzi:

Batman:

mine came when my rego was due

If that's true, it's just bad luck. They probably send out millions of these scam emails, so no doubt there's a good chance that at least 1 in a million has a rego due.

Mine too. I wonder if there's more to this timing than meets the eye. I received a fake email reminder about a month before my renewal was due - right when I was expecting to see the real email. The real one arrived a few days later. Have never received a fake at any other time.

Sometimes I just sit and think. Other times I just sit.

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#2927939 15-Jun-2022 13:44

Not if you made use of the hold.

All driver licences, WoFs, CoFs, and some vehicle certifications, that expired on or after 1 January 2020 will be valid for up to six months from 10 April 2020, Transport Minister Phil Twyford has announced.

And the remainder of the extensions finished May31 this year.

Basically June is a good month to send them out. As it times to when was extended a few times around the lockdowns + 6/12 so will likely be a lot in that pool.

Lego

Shop now for Lego sets and other gifts (affiliate link).

Batman

Mad Scientist
30014 posts

Uber Geek
+1 received by user: 6217

Trusted

Lifetime subscriber

#2928001 15-Jun-2022 15:47

eracode:

Batman:

mine came when my rego was due

Mine too. I wonder if there's more to this timing than meets the eye. I received a fake email reminder about a month before my renewal was due - right when I was expecting to see the real email. The real one arrived a few days later. Have never received a fake at any other time.

exactly the same as me!

what personal details did your email contain?

mdav056

616 posts

Ultimate Geek
+1 received by user: 160

Subscriber

#2930139 15-Jun-2022 22:15

I got one of these today, but it looked legit. However, I did not click on it, but rather went to WK site, found it was due, and paid it there. Hope it was the legit WK site... But this is the best way to deal with any such emails from any organization.

gml

amanzi

Amanzi
1354 posts

Uber Geek
+1 received by user: 332

ID Verified

Trusted

Lifetime subscriber

#2930141 15-Jun-2022 22:19

mdav056:

I got one of these today, but it looked legit. However, I did not click on it, but rather went to WK site, found it was due, and paid it there. Hope it was the legit WK site... But this is the best way to deal with any such emails from any organization.

You did the right thing by not clicking on the link in the email. Out of interest, did you check the from address? Or did you check to see where the link would have taken you by hovering over it and checking?

eracode

Smpl Mnmlst
9333 posts

Uber Geek
+1 received by user: 6203

ID Verified

Trusted

Lifetime subscriber

#2930195 16-Jun-2022 08:58

Batman:

exactly the same as me!

what personal details did your email contain?

Can't remember now - but as others have said here, it was very convincing and took me a while to reject it.

I marked it as spam and have tried to find it in my spam folder so I could re-check it and put a photo up on here. Can't find it.

Sometimes I just sit and think. Other times I just sit.

mdav056

616 posts

Ultimate Geek
+1 received by user: 160

Subscriber

#2930252 16-Jun-2022 09:23

amanzi:

mdav056:

I got one of these today, but it looked legit. However, I did not click on it, but rather went to WK site, found it was due, and paid it there. Hope it was the legit WK site... But this is the best way to deal with any such emails from any organization.

You did the right thing by not clicking on the link in the email. Out of interest, did you check the from address? Or did you check to see where the link would have taken you by hovering over it and checking?

No, sorry, didn't check address.

gml

Dell

Shop now for Dell laptops and other devices (affiliate link).

MikeAqua

8024 posts

Uber Geek
+1 received by user: 3818

#2930272 16-Jun-2022 10:13

We've had a couple of these and they both coincided with the expiry dates of the vehicles. It seemed to me the person/people sending the phishing message had access to specific info about our vehicles. We contacted Land Transport with this info but they weren't at all interested.

Mike

1101

3141 posts

Uber Geek
+1 received by user: 1143

#2930293 16-Jun-2022 11:08

Batman: Has the govt dept been hacked? How do they get these information?

Spammers have a huuuge list of @xtra.co.nz adresses , from back when xtra used Yahoo .

a few basic things can HELP keep emails off spam lists, for a while (if on a spammers list , its too late)
dont put email addresses on websites
setup a junk gmail adress. Use that junk gmail for all the various websites & services that want your email adress .
Dont use your company email for private use . Make it known staff are not to do that : Ive seen company email & password used for various website logins .

I occasionally get IRD emails. I think they may be legit , but id never open them or click on their links .
I guess thats an issue now , emails from couriers , ISP's & govt depts etc just cant be trusted as legit any longer

lxsw20

3689 posts

Uber Geek
+1 received by user: 2174

Subscriber

#2930361 16-Jun-2022 13:15

Has anyone got one of these emails they can put up a screen shot? There are plenty of allegations of a govt dept being hacked here, but no proof.

It would be good to know if the email has your name, and car rego in it.

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#2930363 16-Jun-2022 13:17

lxsw20:

Has anyone got one of these emails they can put up a screen shot? There are plenty of allegations of a govt dept being hacked here, but no proof.

It would be good to know if the email has your name, and car rego in it.

Implications, maybe, but not allegations. And noone has actually provided any evidence of any agency being compromised so I don't think that's a fear.

The emails concerned don't have names or car rego's in them because they're deliberately generic, to make them simple for the bad actors to use.

I'd expect any actual suggestion that private information has been compromised, to be taken up directly with the agency concerned, and not on Geekzone.

No signature to see here, move along...

1 | 2 | 3 | 4