Scammers are spreading malware through... physical mail

When it comes to digital scams, the last thing you think of is physical mail. However, some crafty scammers have figured out how to trick people into installing malicious apps that steal their banking details, and it all starts with a hand-delivered letter in the post. But how do they do it, and how can you stay safe?

Scammers impersonate official agencies to spread malware that steals money from banks

Switzerland is being hit by malware that is being “spread” via physical mail, The Register reports. The attack begins with a fake letter claiming to be from the Federal Meteorological and Climate Office, asking the recipient to download an app. The app is a malicious clone of Alertswiss, a legitimate app that warns people about severe weather patterns.

The letter provides the victim with a QR code, through which they can download the fake app. After scanning the code, it does not open Google Play to download the app; instead, it takes the user to a third-party website. If the target proceeds to download the app, it begins intercepting the two-factor authentication code and attempts to access the victim’s bank account through their banking app. From there, the scammer can transfer money to their account.

Luckily, you can easily protect yourself from this scam. First, remember that there are many security risks when scanning QR codes. Only scan a code if you are sure it comes from an official, trusted source.

Additionally, the safest way to download Android apps is to use the Google Play Store. Legitimate companies will usually release their apps through official channels, so if a company asks you to download them through a third-party site, be cautious. And if you do download and install a malicious app, factory reset your Android phone immediately.