We are seeing an increase in email scams that are disguised in a variety of ways to get the recipient to click on links, pay fees, and respond to gather data. These frauds are getting more sophisticated. The subject lines and email content will look legitimate; the fraudsters will be very convincing and will look real.

Members frequently report receiving emails from accounts impersonating our PNS President and/or Treasurer. If you receive such an email please block the sender, report the email to your internal IT department, and delete the email.

Social engineering is a type of malicious attack that relies on individual human interaction and our trusting human nature to trick people into breaking normal security procedures where fraudsters pretend to be a Board or Staff person, or someone genuinely authorized to give instructions on the PNS’ behalf. Spoofing and phishing are both techniques used by scammers to mislead e-mail recipients. Both involve posing as a different sender to trick the recipient into carrying out an action. Spoofing is a technical measure used to change the apparent sender details on an e-mail, while phishing is an attempt to make the recipient hand over sensitive information such as log-in details. The two techniques may be used either separately or simultaneously: in simple terms, spoofing refers to what a scammer does, while phishing refers to what a scammer is trying to achieve.

Some examples:

1. A malicious party sends a fraudulent email disguised as a legitimate email, often purporting to be from a trusted source. The message is meant to trick the recipient into sharing personal or financial information or clicking on a link that installs malware. This hacking allows the fraudster to monitor the account, and acquire the information necessary to assume the identity of one of the parties. The email appears to come from the real party, but any replies go to the fraudster’s email that appears as the party’s true email address but with just one small change, such as an extra letter.
2. A fraudster “spoofs” a staff or Board member’s email address, making it appear that the email is actually sent by the President, Treasurer, or Executive Office asking the recipient to send funds or divulge bank account information. As the spoof involves using what might be recognized as a real email address, readily available on the Internet, the fraudster tries to craft a message that discourages any reply. The fraudster tries to convince the recipient to ignore normal protocols and simply send the funds as directed in the email.
   The email will have some obvious signs of a phishing scam. The email will sound urgent, trying to get you to react quickly and to click on the button, link and/or attachment without thinking.

Good risk management practices to safeguard against email scams include:

• Look at the “Sender” information. Most email services still show you the actual address that the email was sent from.
• Look at the contact information carefully. If you hover over the link – BUT DO NOT CLICK – a different email or website appears.
• Always verify suspicious requests using previously known contact information, or found through independent research, and not contact information provided in the request.
• Do not open attachments that come from unknown senders or that come unexpectedly.
• Never give out sensitive information over the phone or via email.
• Pay attention to details. Grammatical or spelling errors in the email are red flags.
• Independent research. Do not rely solely on the information from the email.
• Protect your computer systems and your data. Change passwords regularly.
• Obtain professional technical expertise to help you protect confidential information through security measures including antivirus software and strong passwords, and to detect potential security breaches.
  If you experience any suspicious emails about the PNS’ activities, please forward them to the Executive Office who will properly report it.