CWGSY emails targeted in phishing attack

Thursday 09 January 2020

A phishing email posing as a bill from Sure has been sent to hundreds of people with 'cwgsy.net' email addresses.

The scam was looking to get people to pay a bill of £58.65 for January 2020, but it was not actually from Sure, despite the email containing a spam warning itself.

Sent at 03:59 on 9 January, the email was sent to hundreds of people in Guernsey with an email ending in @cwgsy.net - an address which Sure owns and operates for some of its customers. 

Tim Stonebridge, Chief Security Officer at Sure, said the list of email address which was visible to all recipients had not been obtained from them. 

Pictured: the email even contained a fraud warning itself.

"We are aware that some .cwgsy email accounts have received a phishing email claiming to be a bill from Sure. This is a fraudulent phishing email that has not come from Sure," he said.

"As this is an attempt at criminal activity, we are working with Guernsey Police. Phishing isn’t a new technique and we’d advise customers to always be vigilant and follow advice on how to avoid becoming a victim of phishing."

Mr Stonebridge said customers should look out for key differences in emails from Sure and phishing emails, including the use of "dear Sir or Madam", something which featured in this scam. Sure would always use its customers full name and account numbers, which could be referenced against other bills.

"We’d like to thank those customers who have recognised this phishing attempt and contacted us. The most secure method for a customer to view their bill is directly on www.sure.com or through the MySure app.” 

 Sure also said it had reported the incident to the Office of Data Protection, although there had not been a data breach on their part.