November 12, 2019

November 12, 2019

Subscribe to Latest Legal News and Analysis

November 11, 2019

Subscribe to Latest Legal News and Analysis

Alert for Employee Education: FBI Issues Warning About Exploitation of “Secure” Websites

We all have been trained to look at website addresses with a critical eye to make sure they have “https,” as those websites are supposed to be secure. The “s” at the end signifies to us that it is secure. The lock at the beginning of the website address is supposed to signify that it is a secure website. This is something that I mention when I offer employee education to clients—they should only open websites that are secure and locked.

Not anymore. On June 10, 2019, the FBI’s Internet Crime Complaint Center (IC3), issued an alert called “Cyber Actors Exploit ‘Secure’ Websites in Phishing Campaigns.” The alert states that cybercriminals are “banking on the public’s trust of ’https‘ and the lock icon. They are more frequently incorporating website certificates—third party verification that a site is secure—when they send potential victims emails that imitate trustworthy companies or email contacts. These phishing schemes are used to acquire sensitive logins or other information by luring them to a malicious website that looks secure.”

In other words, the cyber criminals are spoofing the HTTPS address and the lock icon, just as they are spoofing domain names, signature lines, email addresses and telephone numbers. I guess we shouldn’t be surprised. But it is important that your employees are aware of this new alert and that they be super cautious about trusting the lock icon and the “https” designation.

According to the FBI alert, “[T]he following steps can help reduce the likelihood of falling victim to HTTPS phishing:

  • Do not simply trust the name on an email: question the intent of the email content.

  • If you receive a suspicious email with a link from a known contact, confirm the email is legitimate by calling or emailing the contact; do not reply directly to a suspicious email.

  • Check for misspellings or wrong domains within a link (e.g., if an address that should end in “.gov” ends in “.com” instead).

  • Do not trust a website just because it has a lock icon or “https” in the browser address bar.

Victim Reporting

“The FBI encourages victims to report information concerning suspicious or criminal activity to their local FBI field office, and file a complaint with the IC3 at If your complaint pertains to this particular scheme, please note “HTTPS phishing” in the body of the complaint.”

I am incorporating this information into employee training—you may wish to consider doing the same.

Copyright © 2019 Robinson & Cole LLP. All rights reserved.


About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...