Phish of the Week – when adjectives just aren’t enough

We aren’t really supposed to chuckle at spams and scams.

They’re the vehicles of cybercriminality, after all.

But once in a while we pick one that made us smile, especially if it was an example of a cybercrime attempt that didn’t work out.

Then we write it up an a humorous warning that nevertheless has an educational side.

So when Naked Security reader swallace136, who has an eye for grammatical humour, sent us this phish against UK High Street bank Lloyds, we thought we’d share it.

The subject line is so close to proper English, yet so curiously far from it that it made swallace136 smile:

We have emailed you to let you know that your account has been randomly selected for an annually review. As a result of this your account will be on-hold until you complete the required steps through the link below:

[Annually verification process]

The adjective “annual”, used to describe a verification process that happens once a year, has been turned into the adverb “annually.”

Unfortunately, you simply aren’t allowed to do that in English, as your teacher at school probably told you (whether you learned English as your first language or not).

Adverbs go with, well, with verbs, and describe the manner in which something happened, e.g. well, quickly, annually.

Adjectives go with nouns, and if English wasn’t such a hotchpotch of other languages, they’d be called adnouns, which would be a much more logical name.

So adjectives describe things or people, e.g. good, fast, annual.

Sometimes you can switch adjectives and adverbs around and sound correct.

For example, some dialects of English answer the question, “How are you?” by saying, “I am well,” meaning, “I am doing well.”

Others say, “I’m good,” meaning, “My health is good,” but also sneakily implying that they are “good” in the sense of “well-behaved,” in case you might have thought otherwise.

Australians and Kiwis notably use “I’m good” instead of “I’m well.”

Perhaps they are used to living so far away from everyone else (except, perhaps, each other) that they might as well make the point that they haven’t descended into anarchy since anyone last checked.

But most of the time, it is inexcusable to swap round phrases like long and at length, or lofty and loftily, for all that it might make significantly more sense than mixing up, say, plethora and Pretoria.

A silver lining

Anyway, in this phishing example, the mixup between adjective and adverb is very handy, because it ends up looking peculiar.

Indeed, it looks even weirder than if it said something absurd like Annual vilification process or Annual verification protest, either of which might be excused or overlooked as a mere typo.

So that’s a bad start for the crooks.

It also didn’t help their credibility that they started off by telling you that your account was chosen at random for its annually verification, before giving you three very specific reasons why you need to go through the process:

One of those reasons, if you don’t mind, is the crashingly ironic suggestion that WE THINK YOU ARE A MONEY-WASHING CYBERCROOK.

If you aren’t a crook, you’re hardly going to warm to the accusation, in an unencrypted email, that your bank thinks you are.

And if you are a crook, you’re hardly going to be put off your stride by other cybercrooks, especially those who can’t tell their technicals from their technicalities.

What is even better news for us is that the server they were hoping to use for their criminal activities isn’t working.

By that, we don’t just mean that access to it is blocked by Sophos products (just in case they fix it), but that the crooks don’t seem to have been able to populate it with fake login pages.

Result!

The bottom line

• If in doubt, leave it out. Don’t get into the habit of clicking on links just because you’re inquisitive. Your best defence is to stay well away in the first place.

• Consider running a web filtering product. You can use the full-blown Sophos UTM for free on a spare computer or virtual machine at home. (See below.)

• Don’t click through to login pages from emails. Reputable organisations never send you login links, specifically so that the only login links you get are from crooks and can be ignored.