New phishing scam promises PlayStation 5 giveaway

The PlayStation 5 console went on sale last November, but many hopeful shoppers are still empty-handed. Sony, suffering a chip shortage as a result of COVID-associated supply restrictions, cannot keep pace with demand. Meanwhile, scammers are moving in to take advantage of the hype by offering the chance to win a PS5.

Win a PS5 from a pharmaceutical company

As with most phishing, a careful look reveals trouble. For example, although the scam e-mails in this campaign contain no glaring errors, the sender’s name — India Pharma in this case, an actual organization — is not affiliated with any gaming giveaways.

What’s also suspicious is that the terms and conditions (the very small print at the bottom of the message that most people don’t read) mention an entirely different company: toleadoo GmbH. It too exists. It’s based in Germany and is the subject of numerous user complaints.

The small print also mentions certain “competition T&Cs,” but there is no link to them. Again, we’re looking for suspicious elements, and inconsistencies in legal language are very suspicious.

In any case, to try your luck, the organizers ask you to register your e-mail address.

The next step opens a website bearing the Amazon logo, although with a URL that looks nothing like amazon.com.

The page ramps up the phishing pressure, saying you’re one of ten lucky visitors who can win the coveted console this week, but you have to act in the next minute and 18 seconds — just enough time to complete the short survey and enter the drawing. This, of course, is another example of a pretty effective phishing tactic: Ramp up the pressure with an artificial time constraint and people will panic and rush instead of slowing down to apply critical thinking.

Wheel of Fortune

If you complete the survey and check the rest of the boxes, a dozen identical gift boxes appear on the screen, one of which is the winner. Spoiler alert: You win the prize! Can’t believe your good luck? Well, below are fake reviews from past “winners” to stoke your excitement and keep your vigilance nice and low.

Now comes the catch. A payment of £1 (one pound sterling — around $1.40 at the time of writing) is required to claim the prize. The organizers give no reason for the payment — but in comparison with the price of the console, it’s peanuts. In addition, they promise to cover all postage costs and deliver the shiny PS5 in just one week.

Next comes a request for address, ZIP code, phone number, and (again) e-mail, most of which makes perfect sense in the context of arranging prize delivery. However, at this point, the required payment jumps from £1 to £1.78; again, with no explanation.

The last step is to provide your banking details. The princely sum of £1.78 won’t make the cybercriminals rich, but your card details — in particular the CVV2/CVC2 code — might.

Keep a cool head

To avoid such pitfalls, don’t believe the hype. If you receive a tempting offer, keep your head, and always follow these simple guidelines to help guard against phishing:

• Check information about giveaways and other promos on the organizer’s website;
• Do not follow links in e-mails. Instead, enter the URL manually if you know it, or use a search engine to get there (after making sure the link is not an ad);
• Be very wary if getting a prize requires paying a fee, even if the amount is small. You risk losing more than just the amount requested;
• Guard your personal data carefully, and if you have any doubts about a website, do not enter your contact details on it;
• Use a reliable security solution that warns you when you are about to visit a fraudulent website.