Vodafone customers who have received email messages like the one below, which claim they can view their latest Vodafone bill or invoice, are asked not to click the links or buttons in the same messages. This is because cybercriminals are sending out fake Vodafone email messages to potential victims that contain links or buttons that go to phishing Vodafone websites that steal online account credentials.
Once the cybercriminals have stolen their potential victims’ Vodafone credentials, they will hijack their accounts and use them fraudulently. It is therefore recommended that Vodafone customers view their bills or invoices through the My Vodafone app (iOS and Android), or at www.vodafone.com.
A Sample of a Vodafone Phishing Scam
From: "vpsonlinebillmanager@vodafone.com" vpsonlinebillmanager@vodafonestore.net
Subject: Online Bill Manager - Your Phone Bill is ready to view
Date: 14 June 2017 at 13:05:40 BST
Vodafone
Vodafone bill is ready
Dear Customer,
You can now take a look and manage your latest Vodafone bill for invoice date 09/06/2015. Your total bill for this month is 216.36 GBP.
Don't forget, your line rental is charged a month in advance and calls are charged in arrears.
Click here to view your bill
Benefits of Online Billing
Print replica Paper Bills
Monitor who uses what and how costs are accrued
Practical breakdowns of usage across account and handsets
View costs accrued so far in the month and set alerts
Available 24/7
Finally, if you're yet to take full advantage of our Online Bill Manager, there are many benefits from utilising its tools. These include the ability to print paper versions of your bill, set usage and monetary alerts and create cost centres all available 24/7.
For further information, see our User Guide.
Kind regards,
Customer Services
The links or buttons in the fake email messages may also trigger the download of a malicious compressed file: "Vodafone bill.zip" or Microsoft Word document. The compressed document contains the following malicious Javascript file: "Vodafone bill.js." And, the Microsoft Word document contains Macros, which are a set of programming instructions. If recipients attempt to open the malicious file, they will be redirected to a phishing website where they will be tricked into sending their online accounts credentials to cyber criminals. Or, they may be taken a malicious website where they will be tricked into downloading and infecting their computers with viruses, spyware, ransomware or other malware.
Vodafone customers who have already been tricked by the phishing scam are asked to contact Vodafone for help before their accounts are hijacked and used fraudulently by cyber criminals.