New Netflix Scam Discriminates Against Certain Users To Avoid Detection

Netflix is becoming quite a lure for phishing scams. A recent one discovered by security company FireEye, sent victims to very realistic-looking web pages where they ultimately were asked to give up all kinds of information including login credentials, payment card details, and even social security numbers.

The scam was so well done that the web page even included a yellow “Secure Server” lock icon in the corner to make it more believable. However, all the information asked for in the form goes right back to attackers. And no one really needs to be told what they tend to do with stolen payment card and social security numbers.

Be on the lookout for these types of phishing email messages. If you have a Netflix account, never click any links that come in email asking for account verification or details. Instead, go directly to your account using a previously bookmarked safe link or by typing the URL into the address line. Most organizations these days understand the dangers of phishing and avoid asking their users to click links to verify such information, so this doesn’t apply only to Netflix but for any online account.

In this scam, the phishers ask for social security numbers, which is probably what gave it away. Very few businesses ask for or need that information in order to provide their services to you, so if they do ask for it, you should question why. In fact, in 2006 the federal government passed laws to prevent companies from asking for that number when they really don’t need it. Those organizations or businesses that can legitimately ask for it include:

• Department of Motor Vehicles
• Welfare offices
• Tax authorities
• Insurance companies
• Credit providers
• The three main credit-reporting agencies – Equifax, Experian, and TransUnion
• Any company that sells products or provides services that requires reporting to the IRS. These include investment banks, or for real estate purchases and sales, and financial transactions over $10,000, for example

Fortunately, this scam is now defunct, but it’s likely others will follow closely behind. And each time one appears it’s more sophisticated than the last. This one, in fact, was able to bypass spam filters by using AES encryption. In addition, the phony pages were hosted on legitimate servers and were coded in such a way that if a user’s DNS (essentially the Internet’s address book) linked to Google, was Netflix itself, or an anti-phishing service such as PhishTank, the page did not appear. Instead the “404 Not Found” dialogue would appear. Now that’s crafty!

Last year, Netflix was used in several scams including one in the UK that attempted to trick people into thinking they actually activated an account by sending around phony invoices. Another one last summer informed users that their account was suspended after they entered payment card information into a form. Then they were asked to download “support software” in order to restore it. Unfortunately, that “software” allowed attackers to gain remote control over the computers. In addition, a list of 1,800 passwords for Netflix accounts was posted on the Internet by a hacker group that supposedly wanted to “teach users a lesson” about not changing passwords regularly.