With the social media regulation for children under the age of 15 coming into force in Türkiye, all eyes turned to the age verification process. However, the new rules are not the only danger that awaits users. Fraudsters may take action to capture citizens' digital information with messages such as "Your account will be closed" and "Verify your age."
Fake websites that imitate the login screens of e-Government or social media platforms can target users' passwords and verification codes. Moreover, the danger may not be limited to just a single social media account. So, which accounts are compromised by clicking a fake age verification link? How do scammers use SMS verification code?
FAKE PAGES CANNOT BE DISTINCTIVE FROM THE REAL PAGES
Speaking to Milliyet.com.tr, Marmara University Faculty Member and Digital Communication Specialist Prof. Dr. Ali Murat Kırık stated that fraudsters can imitate the login screens of e-Government and social media platforms exactly. Emphasizing that even the logo, color, design and trustworthy expressions on fake pages can be compared to the real ones, Kırık said that reliability decisions should not be made based only on the appearance of the page.
Pointing out that citizens should especially check the domain name in the address bar, Kırık stated that age verification links sent via SMS, WhatsApp and social media should not be directly clicked. Reminding that e-Government should only be logged in through the official mobile application or www.turkiye.gov.tr, Kırık stated that fraudsters are now targeting not only money but also digital identity.
THEY CAN TAKEOVER YOUR ACCOUNT WITH A SINGLE SMS CODE
Stating that one of the most dangerous aspects of attacks carried out through fake connections is real-time information theft, Prof. Dr. Ali Murat Kırık said that fraudsters can instantly transfer usernames and passwords to their own systems.
Kırık stated that once attackers enter citizen information on the fake screen, they can try to log in to the real platform with the same information and warned:
"The more dangerous aspect of the matter is seen in SMS verification codes. The attacker can bypass the security stage of the account by asking the citizen to enter the verification code sent to the fake page. In other words, the person can lose control of his account as soon as he shares the code he receives."
Emphasizing that two-step verification is an important security measure, Kırık also underlined that verification codes should not be shared with anyone.
WILL JUST CLICKING THE LINK HAKE YOUR PHONE?
One of the issues that users are most curious about when they click on a suspicious link is whether their phones have been hacked. Prof. Dr. Ali Murat Kırık stated that simply opening the connection and seizing the phone are not the same thing.
Stating that the risk is lower if the person has not entered any information, downloaded a file or installed an application, Kırık said that some malicious links may try to infect malware by taking advantage of security vulnerabilities in the devices.
He suggested checking the following points after a broken, suspicious link:
- Whether there are any unusual changes in the battery consumption of the phone,
- Whether there are unexpected increases in internet data usage,
- Whether there are unknown applications on the device,
- Whether there are any unusual notifications,
- Whether unrecognized account sessions have been opened.
Kırık also stated that files downloaded via the link should not be opened randomly and that the phone's operating system and applications should be kept up to date, and reminded that not every unusual battery consumption means spyware.
HOW TO KNOW IF YOUR ACCOUNT HAS BEEN HIT?
Kırık stated that digital traces should be examined to understand whether a social media account is under the control of others, and drew particular attention to unrecognized sessions. Stating that it is important on which date, at what time, from which IP address and from which device the account is logged in, Kırık said that password changes, e-mail and phone number updates and changes to security settings should also be checked.
In addition, messages sent without the user's knowledge, shares made, deleted content and permissions given to third-party applications may also indicate that the account may have been compromised. Kırık stated that in cases where the attack extends to the phone, downloaded files, installed applications and browser history should also be examined.
ONE PASSWORD CAN RISK ALL YOUR ACCOUNTS
Prof. emphasized that not all accounts on the phone of a person who enters a fake age verification page are automatically compromised. Dr. Ali Murat Kırık pointed out that the real danger may arise when the same password is used on more than one platform. Stating that attackers can also try the passwords they have captured on e-mail, social media and shopping accounts, Kırık said that the security of the e-mail account is especially critical. Reminding that password resets for other accounts are mostly carried out via e-mail, Kırık stated that the capture of the e-mail account may also endanger other digital accounts.
Kırık made the following suggestions to citizens:
- Do not trust links sent under the pretext of age verification without questioning.
- Use different passwords on each platform.
- Enable two-step verification.
- Do not share your SMS verification codes with anyone.
- Especially ensure the security of your e-mail account.
Marmara University Faculty Member and Digital Communication Expert Prof. Dr. Ali Murat Kırık warned that taking over a single account in the digital world could cause other accounts to be endangered.
