Coronavirus phishing scams pose as CDC, schools to steal personal information, experts warn

ByJason Knowles and Ann Pistone WLS logo
Thursday, March 12, 2020
Coronavirus update: COVID-19 phishing scams pose as CDC, schools to steal personal information, security experts warn
While the novel coronavirus spreads in the U.S., hackers are using the outbreak to prey on people's fears.

CHICAGO (WLS) -- While the novel coronavirus spreads in the U.S., hackers are using the outbreak to prey on people's fears.

Experts are warning of phishing attacks that can strike smartphones or other device. In some cases, they can pose as emails from the Centers for Disease Control and Prevention or your child's school.

It's all an attempt to steal your money and personal information.

John Gunn and other security experts at Chicago's One Span said the phishing scams are already reeling in victims in China and Europe, and they're likely headed to the U.S. next.

Todd Kosow, director of the Federal Trade Commission's Midwest office, is also sounding the alarm.

"Based on what we've seen with prior similar diseases like SARS or Zika or Ebola, we are expecting that we will see phishing scams," Kosow said.

They can come in two forms: overall phishing, which can be blasted to thousands of recipients at once, or "spear" phishing. "Spear" phishing involves emails or texts tailored to target you and your children, based on something a hacker may know about you or your family from social media.

"The email would look exactly like the one you get from your school," Gunn said.

A link would take you to a website that looks official, with a URL that looks similar to an official link.

Gunn said the fake school or CDC emails could make you think you or your child has been exposed to COVID-19. They could say your family may face quarantine.

If you click on the link, you may be asked to enter your social security number, birth date or financial information. In addition, your devices themselves could be taken over by a hack, with your banking apps seized.

"It could be a two-stage attack," Gunn said. "You download the malware and later, they steal your money."

Kosow said parents should delete messages and then do their homework.

"One thing we advise that people do in that scenario, is if you have questions - if that email doesn't look like other emails you have gotten from the school - is to contact the school directly at a number or email address that you know to be correct," Kosow said.

The FTC also said there are other COVID-19 scams to beware of, including false claims that there's a vaccine for sale and misleading ads about masks that may not be effective.

As for those new detailed phishing attacks, experts said scammers have sunk to new lows.

"What's different about this one is, it's personal," Gunn said.

The FTC said there are also other phishing emails and texts, which claim to give you prevention tips on COVID-19.

If you did not ask a specific organization for this information, then don't click.