(Skip or read to the end for the latest update / plot twist) I wanted to share some details on the most convincing identity theft attempt that I have been targeted by in order to raise awareness. So here it is...a text message that arrived last week:

Screenshot of an SMS from HM Passport saying your passport will expire within 4 months, with a link to www.smartsurvey.co.uk
  • They know the approximate expiry of my passport - or a lot of people were spammed and it was chance. The potential culprits are few as not many have ever seen my passport.
  • It's a "secure" https link.
  • It's SMS and not blocked by spam filters
  • It identifies as HM Passport Office despite no contact with that name in my phonebook.
  • The link is a legitimate 3rd party survey site as often used by enterprises for internal and external surveys.
  • The language and grammar is appropriate.

Now naturally in my line of work we get a bit paranoid anyway as we come to understand the true extent of information security risks; additionally two aspects of this triggered alarm bells:

  1. The direct link to a survey on a non ".gov.uk" site.
  2. The very concept of an entirely digital passport renewal - though somewhat plausible (and tempting) is enough to incite suspicion.

The direct link to a survey on a non ".gov.uk" site triggered alarm bells

So I googled the link - the only result was a link to the survey site. Only clue here is that there was no hit on a .gov.uk site. So I googled the survey site - looks legitimate.

So I googled "phishing .gov.uk" and got the government scams and phishing website is the first non-paid hit. (Interestingly the "Action Fraud" link has an invalid digital signature, and had an "Unexpected Error" when I tried to report the incident!) The site confirmed that if this was a legitimate message it would be contrary to their own policies; and also this "This might mean you pay for services that you could get cheaper or for free if you used the official government service, eg renewing a passport." - so we now have two potential motives:

  1. Identity theft
  2. Charging for a service that would otherwise be cheaper or free.

The linked page also sets out the circumstances which would require additional documentation or in-person interview. So the survey is intended to ensure I am a qualified prospect in marketing terms; after all they don't want to waste time on someone that doesn't meet their targeting criteria. The other thing they asked was whether I will be travelling in the next 4 weeks - a couple of things here: if much less you need to do in person anyway, or they may have wanted to obtain and use a false passport during the interval while I was still patiently waiting for it.

Because I wanted to be sure someone wasn't doing something daft over at HM Passport, and to give them a heads-up, I took a screenshot of the SMS and sent it to the phishing reporting address. I got this response:

"We can confirm this is a scam and was not issued by HM Revenue and Customs. Do not respond to the message, or follow any links contained within the message. Please continue to report these messages to us at HMRC and also forward the SMS to the ‘Mobile Networks Complaints Message Service’ at 7726.".

HM Passport Office logo

So naturally I did as requested and reported the spam text; and as I'm the curious sort I used a throw-away Gmail account to investigate a little further. The survey landing page is a cut above most phishing attempts as it has appropriate wording, spelling, grammar, the right logos, and a consistent and appropriate colour scheme; it's also not asking anything too invasive at this point so as not to raise suspicion (all with appropriate options):

  • Are you renewing your British passport?
  • Is your passport damaged?
  • Is your passport lost or stolen?
  • How quickly do you need your new passport?
  • Have you changed your name or used another name since your last passport was issued?
  • Looking at your old passport, are your date of birth, place of birth and gender correct?

    (We will reuse these details on your new passport)
  • Looking at your old passport, has your signature changed?

    (We will print your old signature on your new passport)
  • Are you currently a citizen of another country?
  • What is the nationality in your current passport?

On completion there's two potential responses depending if you meet their criteria or not: saying to either use the official government process; or they will be in touch within 24 hours by email. I will update if I get a follow-up email - but I suspect we're dealing with someone too smart to fall for the unsubtle false name I used.

To individuals: Please let other people know about this type of scam and the warning signs to look for. All government services should at least start at a .gov.uk domain. This was the only real clue that this was a scam the rest was highly professional and convincing!

To organisations: Stop sending people links to websites outside the organisation by email or SMS! You are setting your employees up to fail. If you must use a 3rd party service on their domain, rather than a CNAME, then at least include a link to a HTTPS secured intranet page explaining that it is a legitimate 3rd party service engaged by the organisation - and publicise the page so users can check legitimate corporate approved 3rd party service providers' domains.

PLOT TWIST

So today an email arrived in the inbox of "Henry Hunnypot" (I told you it wasn't subtle). Now here's the thing. The email is very convincing, well formatted, and containing an invitation code and links to .gov.uk web pages. This is either a very clever diversion or it wasn't a scam after all...so I called them:

  • Me: "Hi, I got a suspicious SMS and reported it to your phishing team"
  • HM Passport: "Oh yes, that's a new thing we're doing, reminding people when it's time to renew their passports"
  • Me: "Well, it's not following your own policies so I reported it and got told it was a scam by your own anti-phishing team"
  • HM Passport: "I'm sorry to hear you found it confusing would you like to make a complaint"
  • Me: "I'd like to speak to a supervisor"

Some time later and I'm confident the supervisor understands the concern and the problem and will escalate accordingly. I will report back when I get a response - hopefully in less than the 15 days SLA. I repeat my advice from above "Stop sending people links to websites outside the organisation by email or SMS! You are setting your employees up to fail. "

UPDATE 2:

I just got off the phone with the Director General at Her Majesty's Passport Office who reached out last night on LinkedIn. I will write a follow-up with lessons learnt over the weekend and keep you posted.

Follow up now published!

Stay safe out there
Andy