Cybercriminals use classic methods

Cybercriminals use classic methods to successfully convince potential victims. The fraudulent campaign of phone calls in which the attackers present themselves as employees of the National Cyber Security Directorate (DNSC) continues, warn the specialists of the institution. According to experts: "The person is contacted from a phone number that appears to be associated with DNSC. In reality, the number displayed on the recipient's screen is not the real number of the caller. To lure potential victims into the trap, the attackers use a technique called «Spoofing ", in which the attacker uses Voice over IP (VoiceIP) technology to call the victim, taking contact information without the consent of the institution or individual. It is only necessary to know their phone number or contact details , such initiatives cannot be blocked at the level of the telecom service provider". According to them, there are online tools that offer "spoofing" services, most of the time on a pay-per-minute basis: "But attackers do not depend on these services and can create their own tool of this kind with relatively limited resources It is only necessary to hide the original number and replace it with a fake image. The attackers use this fake image to gain the trust of the victim. The attack starts with a call from a person who claims to be an employee of the Directorate, such as Alexandru Ionescu, etc. and says that he wants to help the victims to recover the lost amounts. He then requests the following personal data: full name, IBAN code and the last 6 digits of the CNP. In reality, there are attackers who impersonate DNSC employees". In this context, DNSC specifies that it will never call users to promise them the opportunity to recover lost amounts and will never ask users to provide sensitive data (personal, authentication or bank card data) over the phone, following of calls made by the institution. The Directorate also recommends checking the authenticity of calls from an authority or institution, through a separate communication channel, especially if sensitive data is requested. According to the quoted source, such calls must be reported to the impersonal organization in order to draw attention as quickly as possible to the new scenarios used by attackers in such fraudulent initiatives.