MailGuard 06 January 2022 13:11:48 AEDT 5 MIN READ

Banking Scam: “BOQ Account Closed” Phishing Email Circulating

BOQ (Bank of Queensland) customers should be wary of email’s claiming that there is a problem with their account. A new email phishing scam is being blocked by MailGuard, with the subject of ‘BOQ Account Closed’, it informs recipients that they have ‘1 New Message & Alert In Your Online Banking Account’.

 

Sent from ‘BOQ’, with a convincing ‘noreply(at)boq(dot)com(dot)au’ sender email address, customers could be forgiven for thinking that it may be authentic. To add to it’s credibility, the criminals behind the attack have also included the copyright information and Australian Credit License number for the bank.

Here’s what the email looks like: 

BOQ-email-masked-01

Banks like BOQ are popular targets for scammers, given the trust that most consumers place in their bank, the importance and urgency with which customers are likely to address a problem, and most obviously since the credentials can not only be on sold on the dark web, but they may also unlock access to immediate monetary rewards for cybercriminals.

When a customer clicks on the ‘Log On & View Your Message’ link, they are taken to a convincing phishing page (pictured below) that requests their ‘Customer Access Number’, ‘User ID’ and ‘Password’.

BOQ-phish-page-masked-01

Although the scam is relatively simple in its execution, it does not feature many obvious grammatical errors that are so frequently a warning to victims. Furthermore, the use of Bank of Queensland (BOQ) branding elements and language is also well done. Clicking away from the email or phishing page will take customers to the legitimate Bank of Queensland (BOQ) website, again providing false reassurance that the email is in fact legit.

Bank of Queensland says to customers, If you have received a phishing text message, email or phone call and provided personal information or bank details, call us immediately on 1300 55 72 72 (24 hours a day, 7 days a week). 

If you received a BOQ branded phishing text message, email or phone call, but did not provide personal information or bank details, please let us know via email at financialcrimes@boq.com.au."

MailGuard advises all recipients of this email to delete it immediately without clicking on any links. Providing your personal details can result in your sensitive information being used for criminal activity and may have a severe negative impact on your business and its’ financial well-being.    

MailGuard urges users not to click links or open attachments within emails that:      

  • Are not addressed to you by name.      
  • Appear to be from a legitimate company but use poor English or omits personal details that a legitimate sender would include.      
  • Are from businesses that you were not expecting to hear from, and/or      
  • Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from.     

One email is all that it takes     

All that it takes to devastate your business is a cleverly worded email message that can steal sensitive user credentials or disrupt your business operations. If scammers can trick one person in your company into clicking on a malicious link or attachment, they can gain access to your data or inflict damage on your business.     

For a few dollars per staff member per month, you can protect your business with MailGuard's predictive and advanced email security. Talk to a solution consultant at MailGuard today about securing your company's inboxes.  

Stay up-to-date with MailGuard's latest blog posts by subscribing to free updates. Subscribe to weekly updates by clicking on the button below.  

Keep Informed with Weekly Updates