Romancing The Egg

it’s basically always going to be something super urgent-sounding. an error in a verification process. a mark on your account. you owe money to people who are going to put you in jail if you don’t pay. if you’ve ever had a discord scam get one of your friends, you’ve probably seen the “omg i reported you by accident!!!” thing. they want it to seem important and urgent so you feel you don’t have any time to think about whether or not something sounds Off

very often on social media websites, it’ll have stupid nonsense urls like these accounts do. official brands will never contact you from random accounts with long strings of numbers as their usernames/urls

in fact, 99% of the time, websites won’t contact you through the website at all. if they do, it will be through a popup or banner on the site itself. they won’t contact you through replies like this. websites do the VAST majority of their communication through email, since they know what email address is associated with your account.

so now let’s look at the actual message they’re tagging me in and see what else we can see

oh brother! well, let’s look at some more tells

starting off the message with the very generic “dear user.” any official communication that’s intended to be for you, personally, (so, e.g., not like… a newsletter) from a website or service will address you by name or username. it takes almost zero effort to personalize communications. if they can’t personalize it, that’s a red flag

ending the message with a list of users its contacting. that’s terrible information security! no users should have any information about the internal status of any account but their own. a real communication will only ever be sent to you!

vaguely threatening implications of what may happen to your account. any legitimate communication about “restrictions” on your account will tell you what those restrictions are. remember what i said about them trying to make you panic with urgency? you have “restrictions!” that’s terrible! don’t you want to resolve those quickly?!?

this is a reply on a post. no website is going to be contacting you about your account status in the replies for anything

also, it wants you to go look at the post for further directions on how to fix your “account restrictions.” that’s ridiculous. official communications won’t make you go look somewhere else for next steps. they’ll just include the next steps right there in the initial communication.

so let’s take a final look at the post itself that it wants us to go view and follow

ooh they have a graphic this time! okay so.

they’re still trying to make this seem like a very urgent issue with your account with the “within 24 hours” warning, trying to spur you into quick decisions that you don’t think through logically. don’t let them! websites don’t give notices that short!

they’re doing those things again that i mentioned before—generic message opening (“dear tumblr user”), including a bunch of users in the same message (in the post replies, but still), contacting you through a post instead of email (it just doesn’t happen!)

also, notice that there’s a big discrepancy between the reply and the post about what the issue is. in the reply, the issue is “suspicious activity on your account,” and on the post the issue is “a verification issue.” inability to keep the story straight is basically a guarantee that it’s fake!

it’s trying to get you to a secondary location. websites don’t do secondary locations. don’t click on links that clearly aren’t the website they allege to be. tumblr isn’t going to send you to a place called tumblrauthprocess dot com. they already pay for tumblr dot com! if they really had a method of authentication you needed to complete, it would be at like tumblr dot com slash support slash auth or something like that.

even if you know it’s a fake link and aren’t gonna type anything into it, it’s good infosec practice to not click them anyway. they might put malware on your device.

offering a potential reward—tumblr premium in this case—for doing what the post says. it’s the flip side of the “trying to scare you into acting fast” thing. if they can’t appeal to your panic to make you act quickly, they’ll try to appeal to your desire for Stuff instead. companies might occasionally compensate you for their screw-ups, but they won’t advertise that ahead of time—that not only makes the company look bad (their system screws up so much they have to advertise that you get stuff when it happens??) it also increases the likelihood of bad actors trying to purposefully get the system to screw up just to get free stuff

spotting phishing attempts is easy once you know what to look for. and remember to report the account for the attempt instead of just blocking it—blocking keeps you from seeing that account trying to scam you anymore, but reporting gets the account actioned on so your friends who aren’t so scam-savvy don’t accidentally get phished