Phishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords, and credit card details, often for malicious reasons, by disguising as a trustworthy entity in an electronic communication (i.e. email, direct message, SMS, etc).
In both of the phishing emails the senders tried to spoof the SBSD's domain name by sending from [email protected] and [email protected].
SBSD Phishing Email # 1:
In the first referenced case the subject was "Invitation to Bid". It should be noted that the Department of Small Business and Supplier Diversity "has no involvement in the Bidding or Procurement process".
Sender: Virginia Department of Small Business and Supplier Diversity (SBSD) <[email protected]>
Subject: INVITATION TO BID
Red Flag: SBSD has no involvement in the Bidding or Procurement process.
Below is a copy of the message as provided by SBSD:
*******************************************Subject: INVITATION TO BID
From: "Virginia Department of Small Business and Supplier Diversity (SBSD) " <[email protected]>
Dear Vendor
A bid was just posted matching one of your selected bid category numbers.
----> PRE-PROPOSAL CONFERENCE INFO <----
Mandatory: NO -- The lead entity does NOT require any prospective bidder tobe in attendance at the pre-proposal conference meeting for their bid to be considered.
Conference Date: 04/30/2020
Conference Time: 2:00 PM Eastern Daylight Time
Location: City of Virginia, 101 N. 14th Street, 11th Floor
Richmond, VA 23219 USA
Bid Openings
Note: Bids and bidders are subject to examination. Amounts and ranking may change in accordance with City of Virginia Standard Specifications-- Section 102 “Bidding Requirements and conditions” and Section 103 “Award and Execution of Contract.”
Use the below link to view all active contracts available for bids. (2020 Opening Bids)Conference Document: NO.541327609
----> RETRIEVE BID <--CLICK HERE to view these bid documents.
Thank you for your interest in Virginia Statewide Purchasing.
This email originated from:
City Services -Virginia Department of Small Business and Supplier Diversity (SBSD) [email protected]
*******************************************
In the second phishing attempt the sender appeared as "[email protected]" and the subject displayed as "Virginia Certification Update". This attempt shows that the scammers learned from their previous attempt, providing more relevant content as the email's subject. As scammers adapt so should you.
Sender: <[email protected]>
Subject: Virginia Certification Update
Below is a copy of the message as provided by SBSD:
*******************************************From: [email protected] <[email protected]>Sent: Wednesday, April 29, 2020Subject: Virginia Certification UpdateYou have a message from the Virginia Department of Small Business Services Certification Unit. Please click here to view the attached document for additional details. Should you have any questions, please contact us at 804- 785-6185 or [email protected].Virginia is committed to providing you with excellent customer service. This commitment extends to routine agency inspections, which are necessary to protect the public's health and safety. The Business Owners Bill of Rights ensures that business owners are provided prompt, efficient and easily accessible services.
To view the Business Owners Bill of Rights click here.*******************************************
As a result SBSD sent out an email on April 29th, 2020 with the following guidance:
To validate that emails are coming from the Commonwealth of Virginia and to better filter out phishing attacks like this, you may choose to turn up your email security with SPF and DKIM checking. Please contact your email provider or your support department on how to enable these options.
As a Subject Matter Expert in Email Authentication and DNS Management as well as being a Constant Contact Certified Solutions Provider (Constant Contact being the email marketing platform SBSD uses) I do not believe it is fair for SBSD to place the burden entirely on the end users who are actually the targets and in some cases victims of these phishing attacks. SBSD and other government agencies should steer away from using cheap solutions like WordPress and instead utilize Virginia Small Business providers like Insercorp who understand the importance of properly setting up SPF, DKIM, and DMARC records.
There aren't any comments yet, be the first to add a comment!
Subscribe to the RSS Feed
Made in the U.S.A.