Clever Scammers

Scammers are getting better.

They can create pages with convincing graphics and messages from legitimate businesses such as banks, Web browsers, and health portals. And the other day, they almost got me with a health portal to which I subscribe.

When I started seeing a specialist for my foot problems, he encouraged me to sign up for a Web portal that would let me see the history of my visits, test results, and health tips. We could also keep in touch through secure e-mail messaging.

I signed up and I could see my history of all my visits for cortisone injections and for the surgery that he ultimately performed. After my operation, I'd have several follow-ups, where my surgeon would order x-rays that showed the progress of my healing. And following each meeting, I'd receive an e-mail notification for the results of the x-rays.

When I developed lung issues, after a nasty bout of COVID, I saw a specialist who was also associated with the same hospital as my foot surgeon, and this lung specialist also used the health portal to share test results. My last test result was in May, 2024, after I had my last lung exam.

So, imagine my surprise when I received an e-mail notification that told me I had a new test result and should log on to the health portal.

The e-mail message looked legit: it had the logo of the health portal, with a link to log on to my account. Hovering over the link, the URL also looked legit: I couldn't see anything that looked out of the ordinary, like a misspelling of the portal name or a foreign suffix before the subdirectory part of the URL, which seemed to be random characters (which in of itself, isn't suspicious).

But there was that compelling point that I hadn't had any tests recently; certainly, not in the past few months, if not this year at all. Apart from my usual ailments (lungs and arthritis), I've been in pretty good health this year.

The message greeted me with my first and middle name, which threw me off a bit. How would a scammer have learned of my first name? I go by my middle name and the portal, when I log on, greets me by my middle name.

Maybe the e-mail message was legit?

Because I'm suspicious of practically every e-mail message that I receive with an embedded link, I didn't want to click anything in this message. Instead, I went to my browser bookmarks and accessed the health portal that way.

Because I hadn't logged on in a long time, and because it was the first time that I was logging on from my MacBook, which I've only had for a few months, the portal sent me a secondary authentication and I verified that I was who I said I was.

And guess what? There were no notifications on my account. No test results other than the ones I had seen before.

We have to question everything these days. In times of AI, where a scammer with a bit more ingenuity can make a phishing message seem legitimate, we have to be more vigilant.

Most legitimate messages won't have you asking questions or make you have any doubts. My bank notifies me when they have a promotion or my latest statement is ready, but they have no links in the message, at all. They simply tell me to go to my bank app and log on through it to see details within the message.

They don't threaten you with consequences for not taking action. If you get a message like that, call your bank (not with any number that's provided in the message) and report what you've been told in that message.

Scammers are getting clever. We just have to be even more clever.