National Puzzlers' League Security Notes

Phishing Attempts and Malware

If you get a mail purporting to be from an "administrator at puzzlers.org", no matter what it says, it is probably fraudulent and an attempt to get you to download malware. These emails are known as "phishing" and are a social engineering way of attempting to take over machines, scam you out of money, etc. If you get an email addressed to somebody else which looks suspicious, it probably is.


Here are the important things to bear in mind:

  1. There is no "puzzlers.org Technical Support team" or anything sounding remotely like that. The people who are webmasters for the league are members, real people, and we sign our emails with our noms.
  2. Nobody will ever ask for your password. Never.
  3. Nobody will ever ask for your credit card number, bank account information, or any other personal information. We will never ask for your mother's maiden name or the last 4 digits of your SSN.
  4. Nobody will ever tell you that you need to download anything in order to use the web site, mailing list, or anything else associated with the NPL. Yes, the web site has things you can download (the enigma, word lists, solving tools) and there is plenty of downloadable software that might be useful to puzzlers, but we will never tell you that *have* to download anything. Note: we may provide solving tools in the future that use Java, Flash or Silverlight.
  5. Nobody will ever tell you that you have to visit a specific web page to ensure that you can continue to use the web site, receive email, or do any other thing associated with the NPL or puzzlers.org. This doesn't mean you don't have to pay your dues!
  6. Nobody will tell you that you need to or should pay for anything online. The site does have a link to pay dues via PayPal, but you do not have to use it. Whenever you use a PayPal link, you should check that the URL is paypal.com/etc, not paypal.somethingelse.com/etc.
  7. Just because an email seems to come from an administrator does not mean that it does. If it looks suspicious, it probably is.
  8. Personalized email is not rocket science. Having your nom or email embedded in the middle of an email means nothing.
  9. The use of your name or nom is no guarantee of the authenticity of any email. Most of us have a nom@puzzlers.org alias, so the nom is not a secret.
  • If somebody associated with the NPL web site sends you mail, we will always include our nom. But that alone is not a guarantee that the email is valid. Phishers copy legitimate emails and send modified copies of them to other people.

    All of these statements are pretty much true of any reputable organization or web site. Scammers and phishers use fear as a tactic to get people to act immediately and not question: "you must do this right now or you will lose something." You will never get a message like that from the NPL.

    Don't click on links in unexpected or suspicious email. Instead, visit the site directly and do whatever you think you might need to do. Never click on a link that looks like this: http://legitimate-site.com.other-site.com/etc That's not a link to legitimate-site, it's a link to other-site (which is really evil-site). Many web sites do not begin with www. That's fine. For example, this web site is http://krewe.puzzlers.org. What you have to look closely at is the end of the domain name portion of the URL, not the beginning. For example, a recent scam attempt used this domain: updates.puzzlers.org.secure.redacted.org -- the actual (redacted) domain was a well known malware site with a name that made it sound innocuous.

    If the domain is wrong, it doesn't matter how good the site looks. Scammers have put up very authentic looking copies of bank and credit card sites. You might think they wouldn't bother cloning the NPL site, but their clone tools are pretty automatic. And they think they might steal your password here and then use it at your bank. This is one of the reasons you should use different passwords on each site you use.

    If you receive a link that you are suspicious of in any email, do not click on the link. Instead, manually go to the known site that you want to visit, e.g., by typing "www.puzzlers.org" into your browser.