Clicked on phishing link

Very cross with myself for being fooled. It was an NHS (supposedly) email saying I’d been in close contact with someone with Covid and must order a test kit now and report the results and self isolate for 10 days of positive. Told OH and we were working out who I could have been in close contact with (working from home but had a couple of medical appointments recently). I really fell for it. Then noticed the sent email address wasn’t an NHS one and realised the link to order tests was probably a phishing link. Then saw it said Dear “my email address” rather than my name and if it had been genuine I’d have been notified via the NHS app. Checked that and nothing there.

So once I realised I scanned with AV, Malwarebytes and Norton Eraser (nothing found) and disconnected from the internet while doing that. Turned my iPhone on and off again.

Anything else I should do? I am not entirely sure I did click the link fully. I clicked but nothing happened (ie no web page opened) and then realised. Darn it. Forwarded it to .gov cyber security.

Changed email pw. Set up 2FA for email. Anything else?

As Long as you didn't enter any info like address for the kit. hopefully you should be ok
I didn't think the NHS bothered too much about contacting people now

Yeah stupid of me - they contact you on the phone app if they're going to and the phone app says no current restrictions. And no alerts about close contacts. It's the second time an NHS email has fooled me - first time last year was about vaccinations but someone warned me - and any email with a link in should be seen as suspicious I know. It looked very genuine.

Try to reset your routers IP address and change important passwords. Also try an online antimalware scan.

It's So easy to get caught out these days. I know it is a worry but there is no need to go over the top with security. As far as I know they are after info and they may or may not have your e-mail address, I would think not so a password change is always good and be extra careful over the next couple of weeks.

Cheers. Yes I did a Trend Micro online scan - nothing showed up. Changed email passwords and Apple ID password and a few others. I think my email password "might" have been changed. In the fifteen minutes after I clicked on the link - had trouble logging into it and getting a code sent to my phone. But managed to change it. Slightly concerning! Didn't think about changing IP address. I use a VPN would that do? Have Experian so any attempted fraud would be flagged. But yes they may have my email address. And possibly other info from emails although maybe in 15 mins they wouldn't see much.

One thing I did wonder - I have a firefox account with all logins and passwords saved - which could be viewed. Hmm. Have now set a master password for that so they couldn't be viewed in future. But think I need to change quite a lot of passwords just in case.

Hazel123 said:

One thing I did wonder - I have a firefox account with all logins and passwords saved - which could be viewed. Hmm. Have now set a master password for that so they couldn't be viewed in future. But think I need to change quite a lot of passwords just in case.

Click to expand...

On the plus side, for them to view the Firefox passwords, they'd either need physical access to the computer or be able to remote control it (as in, they can't just grab a file and pull the info, they'd have to use Firefox's built-in functions to see them)

Don't worry too much. You have done the right things, A VPN will really help

Cheers. No issues really, it just occurred to me a lot could have been harvested from my emails. Been trying to find out if either Firefox or Norton actually prevents these links opening actually. When I clicked on it, nothing happened. Norton says it has email protection re phishing, as does Firefox, but no idea how it works and not much info about it. So perhaps the link was blocked from opening (but no notification of that). Although the fact I couldn't sign into my Microsoft account to change the password makes me thinks something did happen. Don't really fancy changing my email address of 15 years!

If you have Norton you may have Dark Web Monitoring Enabled, worth looking there. I know what you mean about e-mail addresses , it's like a thing for life. Did you enter any info or just click on the link?

Did you manage to change the password for your MS Account? When it comes to your email, I would be more concerned about your contact list. I would notify all of your contacts that you can to watch out for suspicious emails that are supposed to be from you. Email addresses like phone numbers can be spoofed.

It might even be a good idea to do a system restore from an image before you clicked on the link. Do it from a USB rescue disk so that Windows and any harmful programs aren't running.

I use a multilevel protection, I only give my main email address to people, organisations I know and trust ... All others get another email address.

This is one on a German company that have very good security and testing for all sorts of malware and nasties.

I then go through a Google address that automatically polls the German address regularly every few minutes and the mail is then checked by Google's tests and my blocked list Etc.

I also use Bitdefender Pro which has a number of anti malware/Phishing and other traps, blocks and scans. These automatically scan all incoming mail, (it also checks outgoing just to ensure I never send any possible malware to anyone, that came to be from any other source)

Hazel123 said:

Cheers. No issues really, it just occurred to me a lot could have been harvested from my emails. Been trying to find out if either Firefox or Norton actually prevents these links opening actually. When I clicked on it, nothing happened. Norton says it has email protection re phishing, as does Firefox, but no idea how it works and not much info about it. So perhaps the link was blocked from opening (but no notification of that). Although the fact I couldn't sign into my Microsoft account to change the password makes me thinks something did happen. Don't really fancy changing my email address of 15 years!

Click to expand...

Unless you consider yourself as a specific target (which depends on what you do professionally), there should be little to be concerned about. I don't think your action caused a hidden service/ spyware to be silently installed to spy on you. By the way, 15 minutes of access is sufficient to upload 1 GB of data, which can contain all your details like usernames, passwords, social security number, basically everything 😀.

Since clicking on the link did nothing, your browser most probably took care of it.

All that said, here's what you should do as a general practice:

1. Secure all your accounts with two factor authentication (2FA).
2. Your email address connected to your financial accounts (banking, investments, etc.) should not be used for casual activities like online services, subscriptions, etc. Keep the main email address (that receives security notifications, OTPs, etc.) exclusively for limited, personal use.
3. Use a browser exclusively for no. 2 (this method is called browser compartmentalization or browser isolation).
4. Configure all your browsers with maximum security (strictest settings possible). This will limit potential damage caused by phishing or other malicious links.

If it's a known scam it's quite likely the link no longer goes anywhere or does anything as the site has been taken down, especially anything relating to the NHS or Inland Revenue, you are unlikely to have been the only target.

Covid scams should be reported t Ofcom.

I probably need to do some work on email. I don't use a spam blocker because I have a business and I need to receive all customer email. This results in literally hundreds of spam emails per day. I clear them quickly, probably losing some customer emails in the process. The good news is that I don't get malware. The bad news is that I have to deal with the torrent of spam once or twice per day. About once per year I change the email address on the website but keep the old one as an alias. Over time the old one cleans itself up pretty well, ready to be used again in the future. I will look into some of the suggestions on this thread. I can do better.

TheMystic said:

Unless you consider yourself as a specific target (which depends on what you do professionally), there should be little to be concerned about. I don't think your action caused a hidden service/ spyware to be silently installed to spy on you. By the way, 15 minutes of access is sufficient to upload 1 GB of data, which can contain all your details like usernames, passwords, social security number, basically everything 😀.

Since clicking on the link did nothing, your browser most probably took care of it.

All that said, here's what you should do as a general practice:

1. Secure all your accounts with two factor authentication (2FA).
2. Your email address connected to your financial accounts (banking, investments, etc.) should not be used for casual activities like online services, subscriptions, etc. Keep the main email address (that receives security notifications, OTPs, etc.) exclusively for limited, personal use.
3. Use a browser exclusively for no. 2 (this method is called browser compartmentalization or browser isolation).
4. Configure all your browsers with maximum security (strictest settings possible). This will limit potential damage caused by phishing or other malicious links.

Click to expand...

Thanks all, that is reassuring. Mystic that is really helpful and makes me realise I haven't had enough security re email before. Since changing my Microsoft/email password (it's an outlook.com account) I have set up 2FA as well using Authy. I have two email addresses for different purposes but one (my oldest one) is my main email for everything and I had relied on site security and 2FA on sites, but I can see now that may not be enough. I tend to do most online banking via a banking app which has it's own security (although mainly just a pin but 2FA for a transaction - rather than using a web browser. No idea of this is more secure, it was just simpler. And I use an iphone because I thought that was less likely to be hacked.

Could you explain a bit more about browser compartmentalisation? I use Firefox for everything usually as all my passwords are saved on the account (except for banking ones, I don't save those) and have usually just closed the browser and restarted it after accessing a banking site. I haven't checked the security settings on Firefox, just left the preinstalled ones - will check that out.

The Hive - strangely I can't find any dark web checking option on Norton - even though when I first installed it asked me if I wanted to check that and I did. Since then nothing seems to be in settings about that. But I guess pwned and Firefox site mentioned above get the same info from the darkweb as Norton.

What I am realising is how much personal information is saved in my email - which is technically vulnerable. Especially in recent years with people doing remote working - eg having to send a scan of my passport to a couple of people for ID (the email still in "sent" folder). And have tended to use my email as online storage - documents in folders etc. So maybe need to go through and remove such things (which will be quite a bit of work).

I'm also wondering if there's a better kind of password manager than using the Firefox account one. It's a pain having a master password set and having to put it in every time I turn on the computer (as it's turned on and off a few times a day). And having to keep looking it up as it's so long and complicated! But I guess I can get used to that and "learn" it. I like the Firefox account one but maybe having one separate from the web browser is better? I know there are a few - any recommendations?

What I would like to do is set up a new outlook.com email and transfer everything across. I am not sure if I can do that. I know if I set up a new email with a different provider I can do that (but like outlook email and don't like the way gmail works or looks). But a new one with outlook.com I think would need to just be an alias and while I've tried that before I found it confusing at times. Like to keep things simple.

No I don't think any malware was downloaded but I do suspect the email might have been hacked and the password changed - as I had such difficulty getting in to change the microsoft password - (2FA failing to work numerous times - so did it on my phone and suddenly had no wifi or mobile signal on my phone so that failed as well). May have been coincidence - mobile signal has been iffy since recent power cuts. But wifi had been turned off. But I have never had an OTP fail to come through immediately from any site.

@Hazel123 maybe it depends on which version of Norton you have, and if you have the classic menu, you will need to click on "My Norton" to see it

Decided to open a protonmail account to see what it's like (the free version). It seems very slow to open emails. Anyone else use it? Just wondering if it's always like that - maybe due to the encryption?