Weekly review 9: Events in Ukraine are being abused for fraudulent emails

08.03.2022 - The number of reports received by the NCSC fell last week. Fake extortion emails purportedly sent in the name of prosecution authorities are still the most frequently reported. Moreover, events in Ukraine are increasingly being used for fraudulent emails.

Unfortunately, current events such as a football World Cup or Olympic Games, as well as catastrophes such as earthquakes or floods always attract fraudsters, who exploit them for their scams. The war in Ukraine is no exception. New information concerning the war in Ukraine becomes public every day. The headlines dominate the news and the war has captured the public's attention. Therefore, it is not surprising that fraudsters are taking advantage of what is happening for their own purposes.

Dubious appeals for donations

Last week, for example, suspicious emails calling for donations for victims in Ukraine were reported to the NCSC. Each of these contained an IBAN to which donations should be sent in order to help. However, if the IBAN is not an official IBAN of a recognised aid organisation, it is very difficult to tell how serious such an appeal is and whether the money will in fact end up benefiting the fraudsters instead of the victims.

UN investment offer

In addition, very obvious fraud attempts were recently reported to the NCSC. A lucrative investment offer by the UN, intended to help war victims in Ukraine, is one example. Investors are supposed to receive EUR 8,000 after a week if they pay in EUR 500. Aside from the already dubious proposal to earn so much money in such a short time, it is even more incomprehensible why the alleged profit should not then benefit the victims.

Figure 1: Alleged investment offer to help people in Ukraine
Figure 1: Alleged investment offer to help people in Ukraine
  • Beware of investment offers that promise a high return.
  • Generally, the greater the promised return, the higher the risk.

Advance fee fraud

Current events are most quickly reflected in advance fee fraud emails. In an email reported to the NCSC, for example, a supposed Ukrainian ship engineer wanted to get his family and CHF 1 million in assets out of the country and needed the recipient's help to do so in return for a share of the assets. However, monetary demands of some sort quickly follow if the recipient accepts. Clearly, the ship engineer is not in Ukraine and the assets do not exist. This is a classical form of advance fee fraud.

Figure 2: Example of advance fee fraud referring to Ukraine
Figure 2: Example of advance fee fraud referring to Ukraine
  • Be sceptical if you receive emails that require action on your part and that carry a threat of consequences (loss of money, criminal charges or criminal proceedings, blocking of account or card, missed opportunity, misfortune) if the action is not performed.

Malware distribution is also possible

In the future, the NCSC also expects to see emails referring to Ukraine that attempt to distribute malware. In earlier similar cases, films about alleged bomb attacks were sent out, and recipients first had to download a video program in order to be able to watch them. However, those video programs contained malware.

  • Do not open any attachments or click on any links in suspicious emails; otherwise, you risk infecting your device with malware.

Last modification 08.03.2022

Top of page

https://www.ncsc.admin.ch/content/ncsc/en/home/aktuell/im-fokus/2022/wochenrueckblick_9.html