Great story, thank you for sharing Andre. We have covered Microsoft support scams in a previous post (http://blog.emsisoft.com/2016/11/17/microsoft-calling-mind-the-tech-support-scammer/), they are still very active and very much a threat. But your experience also highlights the importance of awareness about these types of scams.

This is why we are writing these articles. The more that is known about their tactics, the better prepared you will be to spot if once it happens to you (and let’s face it, it will happen to all of us).

Glad you found the article helpful Chuck. And well done not falling for the Paypal phishing scam: you acted absolutely by the book! As you mentioned, Paypal has long been one of the main companies that are being used by phishing scammers to trick you into clicking on a link. But ebay, amazon and others are also very common.

Excellent suggestion to stress even more to access a site directly rather than clicking a link. We’ll add that to our suggestions that, when in doubt, type in the site directly into the browser and log in.

Have a great day!

Glad you found it useful enough to share it with others; we really appreciate it.
If you feel we have left anything out, let us know and we’ll incorporate it into the article to make it as complete as possible.

Oh and thanks for pointing out our slip up. Fixed it ;)

That said, you raise an excellent point here:

“Think about how meticulous you are about your spelling in an email to a customer, your boss or a work colleague. Now imagine the importance a financial organisation, such as your bank, would place on ensuring all brand communication was immaculately presented…”

On that note I have to say that the word you wanted above that is “piqued”, and not peaked. Just sayin’.)

Hi Azure, thanks for sharing your Apple example with us, and glad to hear we had already flagged it as malicious :)

Great thought on adding a comment regarding the certificate, we’ll make sure to add that into the article!

Decided to investigate a little. So, I copy the links giving into an online unshortening service (They seem to like using link shorteners). Posted the URL at Virustotal, and among the ones the reported the URL as malicious was Emsisoft (Apple should let you guys develop a security software for IPhones).
Even if the link was reported as “clean” I still wouldn’t log-in from an Email that was send without my input. I prefer to go directly to the website on my laptop, and check my account history then.

I already reported the emails and links to Apple. For now, they seemed to have giving up trying to trick me or Apple dealt with them.

Btw, adding to the ‘Look for HTTPS’ segment, it might be a good idea to check the certificate of the site. Cause I highly doubt companies like Google, Apple or Microsoft with their millions of dollars would bother using a Let’s Encrypt certificate. And apparently that’s how some scammers are pretending to be legitimate.

Thanks for sharing your experience Tempus. And glad to hear you’re savvy enough not to fall for them. ;) Surely some of our examples were pretty obvious, but our Lab team is coming across more and more sophisticated scams every day.

Nice tip on the channel. Our Emsisoft channel is actually subscribed to it already, as we agree that there are very useful videos to check out.

Keep the suggestions coming!