Users registered with the Federal Motor Carrier Safety Administration are the target of a new phishing campaign that urges them to complete a form attached to the fake email, according to an alert from the agency.
The forms ask for a social security number and USDOT PIN, information that isn’t required on official FMCSA forms. Carriers should not fill out forms attached to the fake email and always refer to official FMCSA forms for the latest and official documents, the agency warned. In some cases, the phishing attempt also asks for a certificate of insurance and driver’s license to help protect the recipient against fraud.
There also is a threat that if the recipient doesn’t respond within a day, they will be fined, which is not an FMCSA practice.
The fake email originates from either [email protected], [email protected], [email protected] or [email protected], none of which are legitimate email addresses and are not used or owned by FMCSA. If the recipient replies to the email, their message goes to @fmcsa-safety-fmcsa.com, which is also not a domain owned or used by FMCSA. Not only is some of this information personal identifiable information, but this information also would allow the unauthorized party to gain access to the recipient’s FMCSA account.
“The fake email containing the phishing link appears very convincing that the correspondence is from FMCSA,” the agency stated in a release.
Screenshots of the fake email can be found on FMCSA’s website.
Communications from FMCSA relating to information requests of this type would either request individuals to log into their portal account at FMCSA Login (dot.gov), or the email would come directly from an FMCSA dedicated mailbox. While these emails typically end in “.gov,” FMCSA encourages stakeholders and customers to verify any email or communication they feel to be suspicious with the appropriate agency.
What individuals can do:
- Do not click any suspicious links, hover over them to see the real email address of url of that link. Click only on links deemed trustworthy
- Visit the Cybersecurity & Infrastructure Security Agency for more guidance on online deceiving tactics. Learn more about phishing
- The Federal Trade Commission (FTC) recommends following certain procedures for email verification
- File a complaint with the Federal Bureau of Investigations (FBI) by using their IC3 site
- Reach out to the FMCSA Contact Center or call (1-800-832-5660) when targeted