Reαd carefully: how to spot – and avoid – a homoglyph attack

Scam emails are becoming more sophisticated, often employing psychological tactics like using characters that closely resemble legitimate ones. For instance, scammers might use the Cyrillic "α" instead of the regular "a" in an email address or a website URL. This can make it difficult for users to spot the deception, as the altered character may appear identical at first glance.

These attackers leverage similar-looking characters across different alphabets to craft URLs and email addresses that mimic the genuine ones, ultimately redirecting users to fraudulent websites. Such websites can then collect personal information from unsuspecting victims.

Tech experts have observed fraudsters using the Japanese hiragana character "ん" to resemble a forward slash (/) in URLs, making them appear as though they lead to reputable sites like Booking.com. Cybersecurity experts warn that scams targeting the Microsoft brand are particularly prevalent. They may substitute the Latin "c" with the Cyrillic "с" in a URL, like "miсrosoft.com."

Homoglyph attacks are becoming more common because they often bypass traditional security measures. Instead of relying on attachments that can be easily detected by security software, these attacks focus on creating convincing websites that encourage users to click on malicious links.

These scams primarily rely on psychological manipulation, aiming to instill a sense of urgency or panic in victims to prompt quick actions without thorough scrutiny. By exploiting the split-second decision-making process when clicking links, scammers hope to deceive users into providing sensitive information.

Emails or messages requesting immediate action, such as clicking a link or providing login credentials, should be approached with caution. It's advisable to independently visit the legitimate website rather than relying on the link provided in the message. Similarly, when dealing with email addresses, it's safer to manually input the correct address rather than clicking on a link.

Ensuring your browser is up-to-date can help flag suspicious websites and protect against the latest fraud tactics. Additionally, implementing two-factor authentication (2FA) or multifactor authentication (MFA) adds an extra layer of security when logging into accounts. If you suspect a phishing attack, promptly change your passwords and report the incident to your bank and relevant authorities.