Fraudsters are preying on people left desperate by the Covid-19 pandemic across the globe.<\/p>\n
Here too.<\/p>\n
Like this story? Be an amaB Supporter<\/a> <\/span>to help us do more. Sign up for our newsletter<\/a><\/span> to get more.<\/em><\/p>\n In recent months, scammers have masqueraded as the Public Investment Corporation (PIC), the South African Revenue Service (SARS), Transnet and provincial and national health departments.<\/p>\n One scam led the PIC to warn against responding to SMSs supposedly qualifying recipients for a fake PIC-sponsored Business Personal Relief Fund.<\/p>\n According to the PIC, if a person responds to the email address supplied, info@thepub.co.za, they receive an \u201capproval\u201d letter and will have to pay a \u201chandling fee\u201d before the alleged funds are deposited.<\/p>\n \u201cThe PIC is not sponsoring the alleged Covid-19 Business Personal Relief Fund and is of the view that this is an attempt by cunning and ruthless fraudsters whose ultimate goal is to take advantage of vulnerable people when the country is grappling with the coronavirus pandemic,\u201d it said in a statement.<\/p>\n Deon Botha, the PIC head of corporate affairs, told amaBhungane that the state-owned investment manager was notified of the scam on 5 May.<\/p>\n \u201cSo far, we have had two people report the scam, with one having responded to the scam. It was necessary for the PIC to act swiftly to ensure that people do not fall prey to fraudulent activities that perpetuate the PIC\u2019s name and brand,\u201d Botha said.<\/p>\n \u201cThis is the first scam of this nature we have been made aware of,\u201d he said, adding that the PIC has since alerted law enforcement agencies.<\/p>\n Last month, amaBhungane reported how scammers targeted businesses<\/span><\/a> listed on treasury\u2019s central supplier database; a scam tailor-made for the coronavirus pandemic.<\/p>\n Since the start of the year, SARS<\/span><\/a> has warned South Africans against responding to \u201cspoofed\u201d emails and SMSs regarding tax returns, audit queries and missing income tax documents from domain names similar to the official SARS name, sars.gov.za.<\/p>\n The fraudulent messages, SARS said, \u201caimed at enticing unsuspecting taxpayers to part with personal information such as bank account details\u201d.<\/p>\n \u201cFor the period starting from 1 March 2020, there were 23 confirmed phishing attacks reported to SARS. All the fraudulent websites have since been taken down,\u201d said SARS head of communication Siphithi Sibeko.<\/p>\n He added that SARS received over 400 emails reporting phishing attacks from taxpayers since 1 March.<\/p>\n \u201cThe SARS Anti-phishing team ensures that fraudulent websites are taken down and fake sender email addresses are reported to the relevant ISP\u2019s [internet service providers].<\/p>\n “Tracking the fraudsters is almost impossible. Fraudsters make use of compromised websites, fake email addresses, compromised email servers as well as anonymity networks to effectively hide their true identity.\u201d<\/p>\n The irony is that many of the scams look legitimate. A business owner who fell for the industrial sanitizer machine scam that amaBhungane reported on<\/span><\/a> last month, provided us with evidence on how the scammers operate.<\/p>\n The fraud nearly cost him R405\u00a0000<\/a>.<\/p>\n The business owner told amaBhungane that everything had seemed legitimate<\/a>. \u201cThey even had the stamp on the documents.\u201d<\/p>\n He has since opened a criminal case with the police.<\/p>\n The bank which the scammers had used for this fraud has frozen two connected accounts.<\/p>\n International cybersecurity company Mimecast monitored the first 100 days of lockdown<\/a> and found a global increase in \u201ccoronavirus-related spam and impersonation attack campaigns\u201d preying on the vulnerability of people at home and \u201ctaking advantage of their desire for information about the coronavirus pandemic to entice them to click on unsafe links\u201d.<\/p>\n \u201cTraditional fraudsters are also using spam to offer fake or non-existent goods such as protective masks or COVID-19 cures,\u201d the report noted.<\/p>\n Mimecast said it detected a 26% increase of opportunistic scams, a 30% increase of impersonations, 35% in malware and 55.8% increase in blocked URLs and malicious software from January this year to the end of March.<\/p>\n Towards the end of March, Mimecast had blocked the delivery of over 83 million COVID-19 related emails as spam\/opportunistic since January this year.<\/p>\n One case involved an impersonation of the US Centres for Disease Control and Prevention where the scammer tried to engage the public on clicking links that would reveal coronavirus cases in their area.<\/p>\n Other scams tried to persuade users to reveal their personal logins for working platforms such as Microsoft\u2019s One Drive.<\/p>\n The report\u2019s authors said they believed that the attacks would continue throughout the crisis, targeting people\u2019s fears as they were furloughed from work and their cash flows dried up.<\/p>\n The next round of malicious campaigns would most likely take form in organisations helping travellers recoup expenses from cancelled trips or like in the case with the PIC scam, through connecting people to a government grant.<\/p>\n Advocate Jacqueline Fick, a local expert in electronic fraud, asked people to err on the side of caution:<\/p>\n \u201cPhishing emails are set up to deceive the recipient and convince you to divulge information or to get you to act on the request in some other form. In these tough economic times, it becomes even more tempting to respond to such requests.<\/p>\n At the best of times it can be difficult to distinguish between a fake and legitimate email.\u201d [\/sidebarContentStory]<\/p>\n A Transnet scam is also doing the rounds.<\/p>\n On 2 January 2020 at 14:36, someone bought the domain name Transnetegineerings.net. It is almost an exact match to the legitimate website of Transnet\u2019s engineering division: Transnetengineering.net. The only difference is the additional \u201cs\u201d. (See here<\/a>, here<\/a> and here<\/a>.)<\/p>\n Access the documents we used for this investigation, by clicking on the Evidence docket.<\/strong><\/p>\n<\/blockquote>\n In April, \u201cTransnet\u201d requested proposals for the supply of 31 Kerfax e400 Hospital beds via the transnetengineerings.net domain.<\/p>\n The request for proposal document mimicked legitimate tender documents, down to the name of staff in the procurement office.<\/p>\n AmaBhungane reached out to one of the staff members on the official Transnet address and the staff member confirmed the e400 Hospital bed request was a scam.<\/p>\n We contacted the landline number on the fake request for quotation document, and a \u201cTransnet official\u201d answered the call.<\/p>\n When we asked why Transnet needed hospital beds, the operator told us they would be donated to the state-of-the-art Steve Biko Academic Hospital<\/span><\/a> in Tshwane.<\/span><\/p>\n AmaBhungane got hold of the hospital\u2019s procurement staff, who rubbished the idea that Transnet would provide the hospital with more beds: the hospital currently has over 800 hospital beds, plus an additional 53 ICU beds, 21 High Care beds, 61 observation beds, and 108 beds in the oncology complex.<\/p>\n\u2026 and SARS<\/h5>\n
\u2026 and Transnet<\/h5>\n
Uptick in scammers and malware \u2013 report<\/h4>\n
\n