I wanted to share the most convincing identity theft attempt I had been targeted by, to raise awareness. Then it turned out not to be a scam at all, which is a more important story. So here it is...a text message that arrived one Monday:

Screenshot of a text message, the sender's name and the document's name blacked out, saying your official document will expire within 4 months, with a link to www.smartsurvey.co.uk

It was convincing:

  • They knew the approximate expiry of my official document - or a lot of people were spammed and it was chance.
  • It's a "secure" https link.
  • It's SMS, so not blocked by spam filters.
  • The sender's name was the right government department, despite no such contact in my phonebook.
  • The link is a legitimate 3rd party survey site, as often used by enterprises.
  • The language and grammar were appropriate.

Two things triggered alarm bells: the direct link to a survey on a non ".gov.uk" site, and the very idea of an entirely digital renewal of an official document - plausible, and tempting, but enough to incite suspicion.

The direct link to a survey on a non ".gov.uk" site triggered alarm bells

Searching for the link found only the survey site itself, and nothing on a .gov.uk site. The government's scams and phishing page confirmed that a message like this would be contrary to its own policies, and warned of sites that charge for services that are cheaper or free from the official one, such as renewing an official document. The survey's questions - is your official document damaged, lost or stolen, has your name changed, how soon do you need it - fitted either motive: identity theft, or making sure I was a qualified prospect in marketing terms for a paid service. So I sent a screenshot to the government's phishing reporting address, and got this reply:

Screenshot of the reply from a government phishing address, the department's name blacked out, confirming the reported text message is a scam

I reported the text, and, being the curious sort, filled in the survey with a throw-away email account and a false name.

Plot twist

A few days later an email arrived for "Henry Hunnypot" (my phishing pseudonym, I know what you're thinking...subtle right?). It was well formatted, with an invitation code and links to .gov.uk pages. Either a very clever diversion, or it wasn't a scam after all...so I called them. "Oh yes, that's a new thing we're doing, reminding people when it's time to renew their official documents." A supervisor understood the concern and escalated it, and the department's most senior official reached out on LinkedIn and made time to talk it through with me the next day.

When I first got the text it seems my spider sense was working well - I joked with a colleague:

"I'm not sure which is worse, if it's a scam, or if it's legitimate, I fear it may be the latter"

The lessons for any organisation

How can we possibly expect people to be vigilant and do the right thing if organisations don't follow their own guidelines? Especially when this is a function whose entire reason for being is robust identity protection. Each of these issues can easily be remediated if security is designed into the process; the first and last matter most.

  1. Problem: A link to a 3rd party in a text message.
    Risk: Anyone can send a text or email pretending to be someone else (like this example pretending to be NatWest), by spoofing the sender's address or number, or using a compromised account. Teaching people to follow such links teaches them to fall for the fakes.
    Remediation: Never link directly to a 3rd party in an official email or text; link to an official page (here, one ending in .gov.uk), which can explain the 3rd party service on a trusted HTTPS page and link on from there. Or run the service under your own name, even if it's SaaS with a CNAME DNS mapping.
  2. Problem: The government's own anti-phishing team confirmed it was a scam.
    Risk: Mixed messages make people careless, or drive away "customers". Those who followed the link learnt that it's ok to give details to untrusted sites; those who didn't missed out on a convenient new digital service.
    Remediation: Keep a list of official 3rd party links (the whole URL, for surveys or sites anyone can add content to), and make it available to staff, and to the public if appropriate, to check against.
  3. Problem: The Action Fraud page threw an error when I went to report it, and its certificate failed Chrome's checks because its chain used SHA-1.

    Browser address bar showing a certificate warning on https://reportlite.actionfraud.police.uk
    Risk: SHA-1 had become weak enough that certificates signed with it could be forged, which is why browsers were withdrawing trust in them.
    Remediation: Thorough regression testing, and a secure, up-to-date certificate.
  4. Problem: The follow-up email was sent unencrypted, because the sending service did not support TLS.

    Screenshot of email headers, the sender's address and the document's name blacked out, subject Invitation to renew your official document, noting messagelabs.com did not encrypt this message
    Risk: The email could have been intercepted or altered: a malicious link or attachment injected, links changed, or information gathered for other attacks.
    Remediation: Enable TLS on every system that sends email for your organisation, and make sure your 3rd parties have too (more on TLS in Gmail).
  5. Problem: A gap in governance or oversight of the new service.
    Risk: Mistakes like this damage an organisation's reputation as a trusted source, or worse compromise people's information, perhaps leading to identity theft.
    Remediation: The trickiest and most expensive to solve. A new process like this should have had a once-over by a security professional, who would have flagged at least some of these issues. If that really can't be budgeted, make sure your technical staff know policy and best practice and carry out some level of threat modelling; it can be learnt for free by capable sys admins, developers and architects, as can the OWASP Top 10 and the IEEE Top 10 design flaws. Above all, make it a scheduled, non-negotiable non-functional requirement.
Warning: Don't give out private information (such as bank details or passwords), reply to text messages, download attachments or click on any links in emails if you're not sure they're genuine.

To individuals: Please tell other people about this type of scam and the warning signs. All government services should at least start at a .gov.uk address; here that was the only real clue, and the rest was highly professional and convincing.

To organisations: Stop sending people links to websites outside the organisation by email or text! You are setting your employees, and your customers, up to fail.

Perhaps it's time the government started digitally signing all its emails and texts. The DNS Sender Id framework could be extended to publish the public keys of authorised senders, so mail clients could say categorically "This is an official email from this government service". Extend this to other official and corporate email and we would make spotting phishing much easier!

The good news: the department took it seriously, was open and honest about the issues, and made time at the highest level at short notice. I came away confident they would be addressed, and that longer-term lessons would be learnt.

Care must be taken in the transition to digital services.

Stay safe out there
Andy