FBI Warns Scammers Are Using Fake Coronavirus Emails to Steal Personal Information

Zee Krstic
·10 min read
Photo credit: Getty Images
Photo credit: Getty Images

From Good Housekeeping

  • As scammers target families concerned about COVID-19, the FBI, FTC, and the Secret Service are warning Americans to safeguard their information and money.

  • Most scammers are using phishing emails, which could entice you to click harmful links or downloads, or to share your personal information under false pretenses.

  • Others are peddling faulty health products or simply promising to deliver things that never arrive.

While families are concerned about the spread of the novel coronavirus in their communities, online scammers are taking advantage of the understandable panic to peddle useless products to online shoppers. Or, even worse, they're stealing information via phishing scams that are designed to target your personal information or device, according to multiple governmental agencies who are monitoring the situation.

So far, officials at the Federal Bureau of Investigation (FBI) are aware of cybercriminals impersonating officials at the Centers for Disease Control and Prevention and the World Health Organization, as well as communication teams from health organizations in Ukraine, Italy, and Vietnam, according to a report from NBC. And officials at the Federal Trade Commission (FTC) have already served a few cease-and-desist letters to retailers who are trying to profit from fake or misbranded products claiming to combat the COVID-19 disease directly.

The FBI is not the only governmental body responding to claims that Americans are getting scammed: Officials at the U.S. Secret Service are reporting that fraudulent emails are being sent that purportedly contain "new information" about the virus, often requiring people to share sensitive information in order to gain access to these fake updates. Some emails have gone as far as claiming new findings about vaccines for SARS-CoV-2, the virus that causes COVID-19 in humans. And other emails may tug on readers' heartstrings, informing people about potential fundraisers or ways that they could help those affected — before asking you to donate money to a faux cause.

Some hackers could steal your information or invade your privacy simply by getting you to click on a link, which then runs a download that could install malware (bad software) onto your computer. Rachel Rothman, the Good Housekeeping Institute's chief technologist and director of engineering, says to never respond to an email or click on a link within one if you have even just a tiny bit of doubt. "It's better for you to type in a known web address yourself or to pick up the phone and call a known number — for the bank, for example — to inquire and follow up," she says.

But what other advice should you be aware of in the coming weeks, when many Americans are hunkering down in their homes to socially-distance themselves or self-quarantine? And what about health products that you may come across in the search for preventative care? Leading technology and health experts help explain why instructions coming from the FBI, FTC, and the Secret Service are so crucial for you to follow in order to keep yourself safe during this challenging time.

How you can avoid phishing scams:

You may already have received plenty of emails about the spread of COVID-19 in the last few weeks: From employers, your children's schools and universities, or businesses and services that you know well. This makes it easier for phishing emails to go unnoticed, even by someone with a trained eye, especially as most phishing emails are made to look very official with logos or other branding elements. The WHO has already issued a statement about the faux email in its name that's been going around since February; the organization says it would never require you share any personal information to gain access to updated guidance, and officials at the Secret Service say most other public entities operate in the same way.

"Coronavirus is a prime opportunity for enterprising criminals because it plays on one of the basic human conditions — fear," says officials at the Secret Service in a statement. "Fear can cause normally scrupulous individuals to let their guard down and fall victim to [various types of] scams."

Paul Bischoff, a consumer privacy advocate with Comparitech, a research and review firm for digital privacy products, says there's three things you should ask yourself before opening an email from an unknown source:

  1. Does this email make me skeptical? If it's coming from someone you don't know, can you verify if it is on behalf of an institution or an organization that you know well — such as your bank? If so, you might be better off giving them a call to verify the information you're receiving (or any requests for information).

  2. Is it directing me to "click out"? You shouldn't click on links or attachments, as these can lead to phishing sites or malware downloads immediately, Bischoff says. One way to see where a link may bring you is to hover your mouse over any hyperlinks: Often, your email software should allow you to preview the URL associated with this hyperlink — is this for a site you recognize, or one that resembles another website but is deliberately misspelled? If the latter, you should flag the email as spam and delete it, if possible.

  3. Does this email feel too urgent? "Scammers often try to instill a sense of urgency in victims so they don't have enough time to think things through," Bischoff explains. "If you feel rushed, that's often a sign that you're being scammed." This is especially true if the email is asking you to donate to a cause or support a charity fund: "If someone wants donations in cash, by gift card, or by wiring money, don’t do it," the FTC's site says.

Also keep these tips in mind from the officials at the Secret Service:

  • Avoid opening any attachment or links in emails from senders that you don't recognize.

  • Be wary of emails (or phone calls!) requesting account information or to verify an account, as most businesses would never call you or email you directly to ask for your security credentials.

  • Always verify that requests for information comes from a legitimate source. And when in doubt, put a website's domain into a browser yourself: Since most legitimate businesses use encryption known as Secure Socket Layer (SSL), "certificate errors" can be a warning sign that the website isn't valid.

Report suspicious emails: If you feel that you've come across a bogus email, you can report it to the FBI at www.ic3.gov.

How to avoid commerce scams:

Cybercriminals may take advantage of your need to self-quarantine to scam you out of your money. Most scams are "related to safety products and hard-to-find household goods," says Michael Lai, CEO of consumer-advocacy review service SiteJabber.com, which was initially funded by the U.S. National Science Foundation. Currently, most of the complaints being submitted by shoppers to SiteJabber revolve around the travel industry, as people are discovering that travel insurance claims from certain providers may not be applicable for people who are stuck overseas or may need to cancel upcoming travel plans.

"We are starting to see some consumer complaints about sites selling emergency preparedness materials where credit cards are charged, but nothing is delivered," Lai shares. "We are also seeing a lot of complaints of price gouging as desperate consumers are resorting to unknown businesses to purchase things they can no longer find in local stores or even on Amazon." In particular, items like face masks, hand sanitizer, and gloves are being called out in these reviews, Lai says.

If you're shopping online, there may be certain advertisements in your inbox or in your social media feed that could be targeting you, Bischoff says. "If something seems too good to be true, it probably is," he explains, adding that unusually low prices and extraordinary claims are tip offs that an unknown retailer may not be reliable. Follow these tips to ensure your purchase is as legitimate as possible:

  • Look for 'HTTPS': The lack of this established URL domain descriptor may be a signal that the site you are shopping on is compromised, Bischoff says, although some advanced scammers may use sites with 'https' as well.

  • Look for spelling errors: This is the most common sign that something is amiss. "Missing contact information is also another red flag, and no 'about' pages can be signs that you're browsing a scam site," Bischoff says. Always inspect the URL itself for misspelled words, which could be a dead giveaway.

  • Look for subdomains: As an example, amazon.store.com is much different than amazon.com, Bischoff explains. Always check the domain in your browser's URL, as most reputable retailers usually do not have an elaborate subdomain in their web address.

  • Look for merchant reviews: Many retailers will have an official review system for customers to use on their sites, and you should be able to access product reviews or merchant feedback ratings before checking out. "If you're purchasing something on a marketplace like Amazon or eBay, never contact sellers or make payments outside of those marketplaces' official channels," Bischoff says.

Beware of fake health advertising and products:

Both the FTC and the Food and Drug Administration have sent formal warnings to seven different companies that are selling products being advertised as a cure or an effective mode of prevention for COVID-19. The products in question include teas, essential oils, and colloidal silver, with some merchants selling their products directly on their website, or via social media ads and Facebook pages, according to the FTC's announcement. “These products are unapproved drugs that pose significant risks to patient health and violate federal law,” it reads.

Currently, the FTC says there are no legitimate products that can cure you or prevent you from developing COVID-19 directly. "Ignore online offers for vaccinations. There currently are no vaccines, pills, potions, lotions, lozenges or other prescription or over-the-counter products available to treat or cure Coronavirus disease 2019 (COVID-19) — online or in stores." It doesn't mean that a vaccine won't eventually become available: The National Institutes of Health are currently funding an earlier trial to develop a COVID-19 vaccine, according to the Associated Press.

With that in mind, some wellness products may be marketed as aiding your holistic health, or more specifically, boosting your immune system. While it's true that certain supplements or vitamins may be able to help keep your body in good health (alongside proper diet and exercise), Birnur Aral, the director of the Health, Beauty, and Environmental Sciences Lab at the Good Housekeeping Institute, says that it's best to consult your doctor to verify any claims made by supplements or health products before regularly incorporating them into your routine.

The best way to avoid faux health products, Aral says, is to not buy options that are sold by independent merchants on sites like Amazon — especially if they contain no information about ingredients used in the product itself. "I would be wary about products that are sold on the web as a disinfectant, for example, and have no [readily available] ingredient information in English," Aral shares. Any product that has claims to be a one-size-fits-all solution may also be worrisome, she says.

"If it sounds too good to be true, it likely is not true," Aral says. Products that claim to provide personal health protection against the novel coronavirus (or just "coronavirus" in general) may be completely bogus, or simply based on outdated information as COVID-19 is a brand new strain of the coronavirus itself. "If a product claims to work on coronavirus, in the best case scenario, it is referring to the older strain(s) and/or is making false claims."

For helpful resources regarding coronavirus, visit The Centers for Disease Control and Prevention's Coronavirus Disease 2019 fact page and The National Association of County and City Health Officials' directory of local health departments.

You Might Also Like