Phishers Are Taking Advantage of Twitter’s Broken Verification System
People really want to be verified on Twitter; scammers have taken notice. At least one is running Twitter phising ads on the site in an attempt to steal passwords.
Here’s April Glaser, writing for Slate:
The ad from Twitter user @asoiaf_ftw invited me to “Check out” a link to “Get verified on Twitter,” complete with a little white Twitter bird set against the company’s iconic blue background. “Begin now to receive the official blue badge,” the link description read, directing me to click on a link to twittersignup.info, which took me to a site that looked a lot like a Twitter help page, but wasn’t.
This is a transparent attempt to steal the passwords of Twitter users, and Twitter should not have been running these ads. But it’s kind of messed up that verification is desirable enough for this sort of scam to work.
Verification, to me, should mean that the account you’re looking at actually belongs to a given person—nothing more. Twitter turned it into a status symbol, then prioritized backchannels over any official process. This is why scams like this work.
How to get actually verified on Twitter, by the way. The process is shut down at the moment, and even when it comes back applying does not ensure you’ll be verified. But it’s better than typing your password into shady third party sites.
Here’s April Glaser, writing for Slate:
The ad from Twitter user @asoiaf_ftw invited me to “Check out” a link to “Get verified on Twitter,” complete with a little white Twitter bird set against the company’s iconic blue background. “Begin now to receive the official blue badge,” the link description read, directing me to click on a link to twittersignup.info, which took me to a site that looked a lot like a Twitter help page, but wasn’t.
This is a transparent attempt to steal the passwords of Twitter users, and Twitter should not have been running these ads. But it’s kind of messed up that verification is desirable enough for this sort of scam to work.
Verification, to me, should mean that the account you’re looking at actually belongs to a given person—nothing more. Twitter turned it into a status symbol, then prioritized backchannels over any official process. This is why scams like this work.
How to get actually verified on Twitter, by the way. The process is shut down at the moment, and even when it comes back applying does not ensure you’ll be verified. But it’s better than typing your password into shady third party sites.