Email impersonation attacks

Whether you are American Legion staff or a volunteer of The American Legion, be aware that threat actors are always looking for ways to compromise your work or personal email accounts. The American Legion is purposefully an open organization both in its public relations and veterans’ assistance programs. All post, department, and national positions who communicate electronically are at risk of being targeted. Sometimes those attacks come from already compromised email accounts. The message you receive may look very real at first look.

**BEFORE you take action on a request, be certain the email you received was authored by the apparent the sender. If the message looks somewhat wrong, feels not quite right, or asks for something out of character, verify it with the sender.

What we have seen:

“I need a few gift cards or some form of electronic money”
Threat actors or scammers, will attempt to push the recipient to buy gift cards and send the account numbers for the cards over email or SMS (texting). Often the scammer will ask you to send them a text so they can move to a different communication channel. We have also had scammers text first and then move to email.

“Please log in to see this very important document”
This ruse is used most often to dupe the recipient into logging into a fake site. This may be an email host site (Gmail, Hotmail, etc.) or Office 365 depending on what the threat actor knows about the recipient. Once you have logged into this fake site you find there is a junk document. The bad guy now has your account credentials and will be harvesting your messages and contacts and sending out further scams from your mailbox.

If you are in doubt of a message’s validity when the sending address is a known value, try contacting the requestor outside of the email address they use to send. A phone conversation can be the best method to uncover attacks that are in play.

At NHQ we have implemented security measures that alert us immediately when a staff account has been compromised. We have also added multi-factor authentication that prevents a threat actor from logging in even if they have “learned” a user’s password.

We recommend that you set up multifactor authentication for your personal email, financial, and other online accounts containing personal data.

David Yoder is deputy director of IT Operations for The American Legion.

Author: caLegion Contributor

The above article may contain opinions which are the author's own and may not necessarily reflect an official stance taken by The American Legion Department of California. We do our best to vet any information posted to the website. Please email webteam@calegion.org with any changes and/or corrections to anything published here.