The first thing I did was not panic. The second was to move quickly.
But what happened to get to this stage, you may ask, and how could I have been so stupid? I’ll tell you the story.
Every day, like most people, I suspect, I get lots of emails[1]. I have a variety of email accounts, and although I’m sure that I should be more disciplined, I tend to just manage them as they come in. First thing in the morning, though, I tend to sit down with a cup of tea and go through what’s come in an manage what I can then. Most work emails that require more than a glance and a deletion[2] will wait until later in the day, but I like to deal with any home-related ones before breakfast.
The particular email I’m talking about came in overnight, and I was sitting down with my cup of tea[3] when I noticed an email from a company with whom I have a subscription. The formatting was what I’d expect, and it looked fine. It was asking me to change my payment details.
“Danger!” is what you’ll be thinking, and quite rightly. However, I had some reasons for thinking that I might need to do this. I’ve recently changed credit cards, and I was aware that there was quite a high likelihood that I’d used the old credit card to subscribe. What’s more, I had a hazy recollection that I’d first subscribed to this service about this time of year, so it might well be due for renewal.
Here’s where I got even more unlucky: I told myself I’d come back to it because I didn’t have my wallet with me (not having got dressed yet). This meant that I’d given myself a mental task to deal with the issue later in the day, and I think that this gave it a legitimacy in my head which it wouldn’t have got if I’d looked at it in the first place. I also mentioned to my wife that I needed to do this: another step which in my head gave the task more legitimacy.
So I filed the mail as “Unread”, and went off to have a proper breakfast. When I was dressed, I sat down and went back to the email. I clicked on the link to update, and here’s where I did the really stupid thing: I didn’t check the URL. What I really should have done was actually enter the URL I would have expected directly into the browser, but I didn’t. I was in a rush, and I wanted to get it done.
I tried my account details, and nothing much happened. I tried them again. And then I looked at the URL in the browser bar. That’s not right…
This was the point when I didn’t panic, but moved quickly. I closed the page in my browser with the phishing site, and I opened a new one, into which I typed the correct URL. I logged in with my credentials, and went straight to the account page, where I changed my password to a new, strong, machine-generated password. I checked to see that the rest of the account details – including payment details – hadn’t been tampered with. And I was done.
There’s something else that I did right, and this is important: I used a different set of account details (username and password) for this site to any other site to which I’m subscribed. I use a password keeper (there are some good ones on the market, but I’d strongly advise going with an open source one: that way you or others can be pretty sure that your passwords aren’t leaking back to whoever wrote or compiled it), and I’m really disciplined about using strong passwords, and never reusing them at all.
So, I think I’m safe. Let’s go over what I did right:
- I didn’t panic. I realised almost immediately what had happened, and took sensible steps.
- I moved quickly. The bad folks only had my credentials for a minute or so, as I immediately logged into the real site and changed my password.
- I checked my account. No details had been changed.
- I used a strong, machine-generated password.
- I hadn’t reused the same password over several sites.
A few other things worked well, though they weren’t down to me:
- the real site sent me an email immediately to note that I’d changed my login details. This confirmed that it was done (and I checked the provenance of this email!).
- the account details on the real site didn’t list my full credit card details, so although the bad folks could have misused my subscription, they wouldn’t have had access to my credit card.
Could things have gone worse? Absolutely. Do I feel a little foolish? Yes. But hopefully my lesson is learned, and being honest will allow others to know what to do in the same situation. And I’m really, really glad that I used a password keeper.
1 – some of them, particularly the work ones, are from people expecting me to do things. These are the worst type.
2 – quite a few, actually – I stay subscribed to quite a few lists just to see what’s going on.
3 – I think it was a Ceylon Orange Pekoe, but I can’t remember now.
Alice, Eve and Bob - a security blog 
Great blog and enjoyed reading it.
I would recommend to add another step which is to mark the orignal email as spam so the email filters block the sender from sending another similar email.
LikeLike