Compiled by SPEAKIN’ OUT NEWS
Cybercriminals are stepping up their tactics—this time by targeting your paycheck.
The Federal Bureau of Investigation (FBI) has issued a warning about a new phishing scheme involving fake employee self-service websites. These counterfeit portals mimic legitimate payroll, unemployment, retirement, and health savings account (HSA) login pages to steal users’ credentials and redirect their payments.
The scam uses search engine ads that appear legitimate but redirect users to phishing websites. These ads often show up at the top of search results, with minor misspellings or slightly altered URLs that are easy to overlook.
Once a user clicks the fraudulent ad and enters their login information, attackers capture the credentials and use them to access the real account. This can lead to stolen funds through unauthorized wire transfers or changes to direct deposit information.
Multi-Factor Authentication Isn’t Enough
The FBI warns that even multi-factor authentication (MFA) won’t always protect users. Scammers use social engineering tactics—such as pretending to be a bank or HR representative—to trick victims into sharing their MFA codes. Once they have access, criminals can reroute paychecks, withdraw funds, or open new accounts using stolen personal information.
Red Flags:
A major warning sign that your account may be compromised is receiving a flood of spam emails. This technique is used to hide legitimate alerts from financial institutions by burying them in junk mail.
How to Protect Yourself:
- Avoid clicking on ads when searching for login portals—type the URL directly into the browser instead.
- Check the web address carefully for misspellings or unusual characters.
- Use browser ad blockers to reduce the chance of seeing malicious ads.
- Bookmark official sites and use those links to log in.
- Never share MFA codes with anyone who contacts you unexpectedly.
The FBI emphasizes that user caution is critical. Even the strongest security features can be bypassed if users are tricked into handing over sensitive information.