Their strategy includes posing as WHO representatives to solicit money or information from unsuspecting members of the public, the UN agency said on its website.
It listed suspicious behaviours to include asking for login information and sending unsolicited email attachments.
The WHO also warned against links that direct people to websites other than www.who.int, and requests for direct donations to emergency response plans or funds.
While dissociating itself from such acts, the agency warned that scams could come in form of emails, websites, phone calls, text messages and even fax messages.
“If you are contacted by a person or organisation that appears to be from WHO, verify their authenticity before responding,” it said.
Director-General of the organisation, Tedros Ghebreyesus, also tweeted some tips on how to guard against scam and fake news around COVID-19 on social media.
Ghebreyesus urged members of the public to verify information they receive about the virus on social media with official sources such as the WHO.
The following are some of the anti-COVID-19 fraud tips shared by the agency:
The World Health Organisation will:
- never ask you to login to view safety information
- never email attachments you didn’t ask for
- never ask you to visit a link outside of www.who.int
- never charge money to apply for a job, register for a conference, or reserve a hotel
- never conduct lotteries or offer prizes, grants, certificates or funding through email
- never ask you to donate directly to emergency response plans or funding appeals.
Beware that criminals use email, websites, phone calls, text messages, and even fax messages for their scams.
You can verify if communication is legit by contacting WHO directly.
Phishing: malicious emails appearing to be from WHO
- give sensitive information, such as usernames or passwords
- click a malicious link
- open a malicious attachment.
How to prevent phishing:
- Verify the sender by checking their email address. Make sure the sender has an email address such as ‘person@who.int’ If there is anything other than ‘who.int’ after the ‘@’ symbol, this sender is not from WHO.WHO does not send email from addresses ending in ‘@who.com’ , ‘@who.org’ or ‘@who-safety.org’ for example.
- Check the link before you click. Make sure the link starts with ‘https://www.who.int’. Better still, navigate to the WHO website directly, by typing ‘https://www.who.int’ into your browser.
- Be careful when providing personal information. Always consider why someone wants your information and if it is appropriate. There is no reason someone would need your username & password to access public information.
- Do not rush or feel under pressure. Cybercriminals use emergencies such as 2019-nCov to get people to make decisions quickly. Always take time to think about a request for your personal information, and whether the request is appropriate.
- If you gave sensitive information, don’t panic. If you believe you have given data such as your username or passwords to cybercriminals, immediately change your credentials on each site where you have used them.
- If you see a scam, report it. If you see a scam, tell us about it. Report a scam