Email scammers are taking advantage of coronavirus fears to impersonate health officials and trick people into giving up personal information

Advertisement

Check the sender's email domain and see if it matches the website of the organization they say they work for. Then, check the URLs included in the email.

Check the sender's email domain and see if it matches the website of the organization they say they work for. Then, check the URLs included in the email.

In this scam documented by Trustwave, the scammer purports to be from the CDC, but uses an email from a domain other than cdc.gov and includes misleading links that lead to a different site when clicked.

Advertisement

Don't trust login pages with unfamiliar URLs.

Don't trust login pages with unfamiliar URLs.

The malicious link in this scam directs users to a fake Microsoft Outlook login screen to steal their credentials — the unfamiliar URL is a tell.

Advertisement

When in doubt, copy and paste URLs into your browser rather than clicking hyperlinks directly.

When in doubt, copy and paste URLs into your browser rather than clicking hyperlinks directly.

In this case, when the misleading URL is copied and pasted from the email instead of clicked, it shows that the page doesn't actually exist.

Don't give in to scams that make you feel pressured to act quickly.

Don't give in to scams that make you feel pressured to act quickly.

Scammers highlight the language of emergencies to make victims act more quickly. The WHO has urged people to resist giving in to panic and to think twice about whether an email looks legitimate. If the information is supposedly public, there's no reason to submit login credentials in order to see it.

Advertisement

If you already handed over sensitive information, change your passwords now.

If you already handed over sensitive information, change your passwords now.

Don't panic if you believe you've already given your login credentials to a fraudster — change all your passwords to online accounts now, and set up multifactor authentication whenever possible.