Session 4: Phishing, Scams & Malware

Phishing is a message designed to make you act before you think, and it arrives in every format. Email phishing uses urgency and impersonation — a bank warning, a delivery failure, an invoice. SMS phishing carries a link and a claim that something needs your attention. WhatsApp is where most Nigerian phishing actually happens, because it arrives from a number that looks plausible, often with a familiar name and photograph, and the medium itself signals trust.

The tells are consistent across all of them. Urgency — a deadline of minutes or hours, which exists only to suppress the checking you would normally do. An unexpected request — nobody was expecting this message, and that is precisely why it works. A request for a code, a payment or credentials, which are the only three things an attacker actually wants. A link whose destination differs from its text — hover or long-press to see where it really goes. And subtle sender errors: a domain one character off, a number that is not the organisation's, a display name that does not match the address.

Voice phishing deserves separate mention because it is under-recognised. A caller claiming to be from your bank, your network operator or the police, speaking confidently and creating urgency, is more persuasive than any email. The defence is identical and simple: hang up and call back on a number you obtained independently — from your card, your bill, or the organisation's official site. No legitimate caller has any objection to that.

SIM-swap fraud begins with an attacker gathering enough about you to convince your network to move your number to their SIM. Once they hold your number, every SMS one-time code goes to them, and account takeovers follow quickly. The defence is a port-out PIN or account PIN on your mobile account — most Nigerian networks offer one and most people have never set it. This is a five-minute action that closes a serious hole.

Fake payment alerts target businesses: a forged transfer notification arrives, apparently genuine, and goods are released before the money is checked. The rule is absolute — verify in your own banking app, never from a screenshot or an SMS, because both are trivially forged. One-time-code requests arrive posing as a bank, a network or a delivery firm; no legitimate organisation ever asks for a code, so treat any such request as an attack without analysis.

Impersonation of someone you know is the most effective, because it defeats suspicion entirely — a WhatsApp message from 'your sister' with her photograph asking for urgent help, or 'your boss' asking for a favour. The defence is verification through a second channel: call the person on the number you already have. And romance and investment scams run long, building trust over weeks before asking for money; the marker is not the story but that money is eventually requested, always urgently, always to an unfamiliar account.

In Nigeria, malware most often arrives through pirated software — a cracked activation tool, a 'free' licensed program, a modified installer. This is the dominant route and it is worth being blunt about with clients: the activation crack that saves a licence fee routinely carries a payload that costs far more. Attachments and downloaded files are the second route, and malicious browser extensions the third.

The families matter because the response differs. Ransomware encrypts your files and demands payment — the only real defence is a backup, because paying does not guarantee recovery and marks you as someone who pays. Infostealers silently harvest saved browser passwords, cookies and wallet keys, which is why a session token can be stolen without any password being guessed. Spyware and keyloggers record what you type. Banking trojans intercept and modify transactions. And cryptominers simply consume your machine, making it slow and hot — which is often how they are noticed.

The signs of infection are worth memorising: unexplained slowness, a fan running constantly at idle, browser redirects or a changed homepage, new toolbars or extensions you did not install, pop-ups, passwords that stop working, and contacts reporting strange messages from your accounts. Any of these is a reason to stop using the machine for anything sensitive until it is checked.

The response in the first hour determines how bad the outcome is, and it has a fixed order. Disconnect — take the machine off the network, or if it is an account, stop using it. This limits what an active attacker can do. From a different, clean device, change the password on the affected account and on your primary email, because email resets everything else. Enable or reset two-factor, since an attacker may have added their own.

Then revoke active sessions — most email and social services list logged-in devices and let you sign all of them out, which defeats an attacker holding a stolen session token even after a password change. Check the recovery details, because changing the recovery email or phone number is one of the first things an attacker does and it locks you out later. Notify the bank immediately if money is involved, and report to the platform.

In Nigeria, report fraud to the relevant platform and to the police, and consider the EFCC for financial fraud. Reporting rarely recovers money on its own, but it creates a record, which matters for any bank claim, and it contributes to the data that makes these operations harder. Finally, tell the people who might be affected — if your social account was used to message your contacts, they need to know to ignore it.

Run a full scan with Windows Defender and a reputable second-opinion scanner, in Safe Mode where possible so active malware is not running to defend itself. Remove what is found, then check the places persistence hides: startup entries, scheduled tasks, browser extensions, and recently installed programs sorted by date.

But be honest about what cleaning achieves, because this is where technicians overclaim. Scanners remove what they detect; they cannot guarantee that everything is gone, and infostealers have already sent your credentials the moment they ran — removing the malware afterwards does not un-send them. So the correct sequence after any real infection is: remove it, then change every password stored in that browser and revoke sessions, because you must assume they were taken.

For a serious infection, and always for a machine used for banking or business, the honest recommendation is a clean reinstall — which session seven of Computer Repairs covers in full. A cleaned machine is probably fine; a reinstalled machine is known to be fine. Recover the data first, verify the copy, then install clean. Where the customer handles money, 'probably' is not an acceptable standard, and saying so is the responsible advice even though it is more work.