Fake Cover-More Insurance Emails Carry Malware
Email purporting to be a policy purchase notification from Australian travel insurance provider Cover-More urges recipients to open an attached .zip file to view a Certificate of Insurance.
The email is not from Cover-More. The attached file contains malware. If you receive one of these emails, do not open any attachments or follow any links that it contains.
Subject: Cover-More Travel Insurance Cover (policy number: 82857894)
Thank you for choosing to travel with Cover-More Travel Insurance.
You have chosen to purchase a policy with Australia's most popular travel insurance provider, trusted by over 1,000,000 Australian travellers each year.
Attached is a copy of your Certificate of Insurance along with a copy of the Product Disclosure Statement (PDS), which we encourage you to read.
Remember to keep your emergency assistance card with you when travelling and our 24 emergency assistance team are here to help you.
We hope you have a safe and enjoyable journey,
Cover-More Travel Insurance Team
P 1300 72 88 22 | E firstname.lastname@example.org
A Private Bag 913 North Sydney NSW 2059
This email, which claims to be from popular Australian based travel insurance provider Cover-More
, masquerades as an insurance policy purchase notification. The email encourages recipients to open an attached .zip to view the Certificate of Insurance along with a Product Disclosure Statement.
The message is not a genuine Cover-More insurance notification and the attached file does not contain insurance information as claimed. In fact, unzipping the file and running the .exe file that it contains will install malware on the recipient's computer. Typically,
once installed, such malware can make connections with remote servers operated by criminals, download further malware components and harvest personal information from the compromised computer. Often, criminals are able to use the compromised computers to launch further spam and scam campaigns.
The criminals responsible for this malware attack hope that at least a few recipients, curious about why they would receive a purchase notification for a policy they never ordered, will
open the attached file without due forethought. And Cover-More customers who have recently purchased a policy may be inclined to think that the message is legitimate.
Cover-More has published a notice
on its website warning people about the malware emails. Cover-More does not send out policy information via .zip or .exe files. If you receive one of these emails, do not open any attachments or click on any links that it contains. If you have already opened the attached file, you are advised to run up-to-date anti-malware and anti-virus scanners to clean any malware from your system.
Last updated: April 17, 2013
First published: April 17, 2013
By Brett M. Christensen