Beware Email Scams Seeking Feedback on the UK’s Emergency Alerts Test

The recent nationwide mobile test of the UK’s new Emergency Alerts service has, perhaps inevitably, been followed by a new wave of email phishing scams and spams over the past week. This attempts to impersonate the government by claiming to seek feedback from recipients on whether or not they received the alert.

As usual with such things, the messages are structured in a way to look authentic, but neither the sending email addresses nor the main source links contained within the body of the message are from official government sites and servers (these would usually redirect to gov.uk addresses, rather than some random AWS servers or unfamiliar websites).

Some feedback online suggests that a few people didn’t think these messages were scams because they referenced a system test that did take place. But this only serves to highlight just how effective good timing and the appearance of authenticity can be for scammers. Unfortunately, these emails are very much the product of fraudsters.

The goal of such phishing messages is usually to harvest personal, security and financial data or to try and infect your device/computer with some sort of malware (virus, trojan etc.). Suffice to say, you should never click on links in unsolicited emails. A quick check of the “From:” address (sending field) in the message source, or hovering your mouse over (not clicking) the main email links, often helps verify whether a message is legitimate or not.

In the case of this specific example, the aim of the fraudsters seems to be to get end-users who fall for their trap to execute a series of commands and thus run malicious Powershell code on Windows PCs, resulting in a malware infection. The message and its follow-on process will not fool seasoned internet users, but of course the scammers are only interested in the sub-0.1% of people who might be tricked by it.

We’ve seen a number of variations of this particular ’emergency alerts’ scam, so be on your guard.