COVID-19 scammers might have stolen millions from the German government

Fraudsters could have stolen tens of thousands of millions of euros earmarked for German COVID-19 financial aid after a province failed to assess the identity of applicants properly, according to Handelsblatt. The cybercriminals used a classic phishing plot: First, they created a copy of this official website used by the North Rhine-Westphalia (NRW) state to distribute coronavirus aid to companies and self-employed folks. They then found an email campaign to lure users into the bogus website and steal their credentials. At length, the scammers requested financial aid on behalf of those individuals when utilizing their bank accounts.

The plot went on for around three weeks before April 9th, when the local authorities temporarily suspended payments and required its site offline. Meanwhile, police received 576 official fraud accounts, with payments varying from $9,000 to $25,000. That means that the government may have lost between $31 to $100 million (roughly $34 to $109 million).

The problem happened since the NRW government -- unlike other German state governments -- failed to ask scanned identity documents. Instead, applicants only had to complete forms on the website without any additional confirmation. The government has put its coronavirus funding website back online (with additional ID verification in place). It will just honor previous financing requests if, in the event, the candidate's bank accounts were already on record.

A programmer in Cologne advised ZDNet that he may have fallen for the scam also, as the NRW government generated an all-new and unfamiliar website. "This was a new website that no one had seen before, and we would not have been able to tell whether it was the real one or not," the unnamed man said. "This explains why so many fell to it and entered private data."