Summer of scams: Cottage trips make life easier for fraudsters targeting Finland

Summer holiday life split between home and mökki could make people in Finland less cautious about attempted scams, and more susceptible to fraud.

A Finland Insider subscriber reached out after falling victim to a simple scam he says that normally he would have easily spotted and ignored.

Heikki, who asked not to use his real name, is spending part of the summer in the Turku Archipelago, and part of the summer at home in Helsinki.

“When I think about it now, I wonder how did I fall for it?” he asks.

The scammers started with a phishing expedition in the form of an email pretending to be from Posti saying that they’d tried to deliver a parcel but since nobody was in they would try the next day for a small 30 cent fee.

“I was waiting for a delivery but didn’t remember if I ordered it from home or from mökki so the email from Posti seemed legitimate,” he tells Finland Insider.

Heikki gave his debit card number and only when he looked more closely did he see the Posti website had a strange URL address - www.postixyz.fi - while a follow-up text message came from a +60 country code number which is Malaysia.

Posti’s anti-scam advice

On its website, Posti offers extensive anti-phishing and anti-fraud advice, but Iikka Salmela, Chief Information Security Officer at Posti says the scammers are always switching up the way they operate.

“So some extent we see patterns but what concerns me the most is that whenever we tackle some aspect of the scams, whenever we take a stop to block one domain, the scammers keep evolving.”

“The basic concept however stays the same. They have a well-crafted message and they’re trying to get your banking codes,” Salmela tells Finland Insider.

The scams which Posti monitors in Finland most often come from Asia, Africa or the US, and Finnish authorities including Posti and Traficom are working with their counterparts in the Nordic region to share information about the various fraud attempts doing the rounds at any given time.

Hunting the fraudulent sites

Traficom publishes a weekly report into cyber security issues including phishing scams - and the most recent report warns specifically about Posti-related scam attempts.

“In Finland we can tackle the sender ID, we can block the use of the Posti name in SMS text messages,” explains Posti’s Iikka Salmela.

“We hunt down fraudulent web pages and if we find a webpage impersonating Posti we try to do a shutdown of the page immediately. The same goes for Facebook. There’s a popular scam were they say they’re selling parcels which are unclaimed, and that is a fraud, it’s not real,” he says.

Posti advises the most secure ways to beat the fraudsters is to use their proprietary Omaposti app [Google Play link] where customers can set up their own account and be assured that’s the only official way to communicate with Posti, who will never ask for bank codes or account details.

Out in the Turku Archipelago, Heikki realised just in time the mistake he’d made by entering his bank details to the phishing email from scammers, and had to contact his bank to put a hold on his account so he wouldn’t lose any money.

“I’m always quick to tell my wife or daughter that something’s a scam when they receive fake emails, and everything comes in perfect Finnish, you really have to be very careful and double check.”