If you’re a Microsoft or Apple user, have a MasterCard, buy things at Amazon, or use AT&T or T-Mobile for your phone service, the next time they come knocking on your door, don’t answer.
At least be careful, because those companies are just six of the most impersonated brands that internet and cybersecurity company Cloudflare lists in its 2023 Email Threat Report.
Drawing from the 112 billion daily threats Cloudflare blocks every day – double the volume of a year ago – the company suggests that today’s email filters are doing a rather lousy job of protecting us, too. “Email authentication doesn’t stop threats. The majority (89%) of unwanted messages ‘passed’ [traditional security checks].”
Instead, the brainiac scammers of 2023 are laying in wait, watching what emails are being sent to a person or company and what the subjects of those emails are.
Then, when they’ve got all the evidence they need, they pounce with something eerily similar. Cloudflare researchers say that attackers may be “inside” your email account for weeks or even months.
The Top 10 most impersonated brands overall
When you look at this list, you’ll see why an impersonator would want to play pretender. With the millions of users/customers these brands have – like Microsoft’s 25 million monthly users – it’s like shooting at fish in a barrel.
1. Microsoft
2. World Health Organization
3. Google
4. SpaceX
5. Salesforce
6. Apple
7. Amazon
8. T-Mobile
9. YouTube
10. MasterCard
11. Notion.so
12. Comcast
13. Line Pay
14. MasterClass
15. Box
16. Truist Financial Corp
17. Facebook
18. Instagram
19. AT&T
20. Louis Vuitton
Social media impersonators
Another easy target is social media. As anyone who has notifications to any of their social media accounts knows, they can get pinged more than a dozen times a day. And lurking inside of those pings could be someone impersonating any of these Top 10 companies:
1. YouTube
2. Facebook
3. Instagram
4. WhatsApp
5. Pinterest
6. Parler
7. Twitter
8. LinkedIn
9. Discord
10. Reddit
Financial Service Brands
Banks and credit card companies are growing favorites of impersonators, basically because there are fewer dots to connect and hoops to jump through to connect a consumer’s account to the impersonator breaking into that account and hauling off personally identifiable information and money.
Number one this time around is MasterCard. followed by Truist Financial, Investec, Generali Group, a trio of digital currency companies Bitcoin, Binance, and OpenSea, Bank of America, Visa, and Nationwide.
What’s changed that consumers need to be aware of
Just like every other scam, brand impersonators are burning the midnight oil to stay ahead of all the filters that protection filters and software can throw at them. Package delivery and account confirmation scams still exist, but the impersonators have new tricks they’re trying out, says Oren Falkowitz, field CSO at Cloudflare.
The biggest shift is in what “appears” to be real – thanks in great part to the rise in artificial intelligence (AI).
“A common misconception is that the only elements we need to look for are low-quality images or broken language. However, today’s attacks are incredibly sophisticated, mirroring messages that look like what we would consider ‘normal,’” Falkowitz told ConsumerAffairs.
Another wave that scammers are riding is what’s in the news. Yes, like the Maui fires, the World Cup, even Britney Spears getting divorced.
Falkowitz says that the content in the malicious email campaigns Cloudflare is seeing now follows the flow of real-world events and headlines. If you get an email that talks about a current event, you’d be smart to say, “Hey, is this real or not?”
However, AI might actually cross back over from the Dark Side in our favor – eventually.
“Counterintuitively, when it comes to detection and technical controls, the usage of AI creates extremely straightforward patterns that modern-day phishing tools should be able to identify and preempt,” Falkowitz said.
